Commit 2fae3129 authored by Hans de Goede's avatar Hans de Goede
Browse files

platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors 



x86_android_tablet_remove() frees the pdevs[] array, so it should not
be used after calling x86_android_tablet_remove().

When platform_device_register() fails, store the pdevs[x] PTR_ERR() value
into the local ret variable before calling x86_android_tablet_remove()
to avoid using pdevs[] after it has been freed.

Fixes: 5eba0141 ("platform/x86: x86-android-tablets: Add support for instantiating platform-devs")
Fixes: e2200d3f ("platform/x86: x86-android-tablets: Add gpio_keys support to x86_android_tablet_init()")
Cc: stable@vger.kernel.org
Reported-by: default avatarAleksandr Burakov <a.burakov@rosalinux.ru>
Closes: https://lore.kernel.org/platform-driver-x86/20240917120458.7300-1-a.burakov@rosalinux.ru/


Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20241005130545.64136-1-hdegoede@redhat.com
parent 5984b40f

drivers/platform/x86/x86-android-tablets/core.c

+4 −2
Original line number Diff line number Diff line
@@ -390,8 +390,9 @@ static __init int x86_android_tablet_probe(struct platform_device *pdev) 
	for (i = 0; i < pdev_count; i++) {

		pdevs[i] = platform_device_register_full(&dev_info->pdev_info[i]);

		if (IS_ERR(pdevs[i])) {

			ret = PTR_ERR(pdevs[i]);

			x86_android_tablet_remove(pdev);

			return PTR_ERR(pdevs[i]);

			return ret;

		}

	}
@@ -443,8 +444,9 @@ static __init int x86_android_tablet_probe(struct platform_device *pdev) 
								  PLATFORM_DEVID_AUTO,

								  &pdata, sizeof(pdata));

		if (IS_ERR(pdevs[pdev_count])) {

			ret = PTR_ERR(pdevs[pdev_count]);

			x86_android_tablet_remove(pdev);

			return PTR_ERR(pdevs[pdev_count]);

			return ret;

		}

		pdev_count++;

	}