Re: [PATCH] usb: chipidea: ci_hdrc_imx: fix potential error pointer dereference in probe

From: Peter Chen <peter.chen@kernel.org>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Fabio Estevam <festevam@gmail.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Shawn Guo <shawnguo@kernel.org>,
	Sascha Hauer <s.hauer@pengutronix.de>,
	Pengutronix Kernel Team <kernel@pengutronix.de>,
	NXP Linux Team <linux-imx@nxp.com>,
	Frieder Schrempf <frieder.schrempf@kontron.de>,
	linux-usb@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: [PATCH] usb: chipidea: ci_hdrc_imx: fix potential error pointer dereference in probe
Date: Sat, 20 Nov 2021 14:16:24 +0800	[thread overview]
Message-ID: <20211120061624.GA3874@Peter> (raw)
In-Reply-To: <20211117074923.GF5237@kili>

On 21-11-17 10:49:23, Dan Carpenter wrote:
> If the first call to devm_usb_get_phy_by_phandle(dev, "fsl,usbphy", 0)
> fails with something other than -ENODEV then it leads to an error
> pointer dereference.  For those errors we should just jump directly to
> the error handling.
> 
> Fixes: 8253a34bfae3 ("usb: chipidea: ci_hdrc_imx: Also search for 'phys' phandle")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
>  drivers/usb/chipidea/ci_hdrc_imx.c | 18 +++++++++---------
>  1 file changed, 9 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
> index f1d100671ee6..097142ffb184 100644
> --- a/drivers/usb/chipidea/ci_hdrc_imx.c
> +++ b/drivers/usb/chipidea/ci_hdrc_imx.c
> @@ -420,15 +420,15 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
>  	data->phy = devm_usb_get_phy_by_phandle(dev, "fsl,usbphy", 0);
>  	if (IS_ERR(data->phy)) {
>  		ret = PTR_ERR(data->phy);
> -		if (ret == -ENODEV) {
> -			data->phy = devm_usb_get_phy_by_phandle(dev, "phys", 0);
> -			if (IS_ERR(data->phy)) {
> -				ret = PTR_ERR(data->phy);
> -				if (ret == -ENODEV)
> -					data->phy = NULL;
> -				else
> -					goto err_clk;
> -			}
> +		if (ret != -ENODEV)
> +			goto err_clk;
> +		data->phy = devm_usb_get_phy_by_phandle(dev, "phys", 0);
> +		if (IS_ERR(data->phy)) {
> +			ret = PTR_ERR(data->phy);
> +			if (ret == -ENODEV)
> +				data->phy = NULL;
> +			else
> +				goto err_clk;
>  		}
>  	}
>  
> -- 
> 2.20.1
> 

Acked-by: Peter Chen <peter.chen@kernel.org>

-- 

Thanks,
Peter Chen