ccp_debugfs_init() registers debugfs files whose private data is the devm allocated ccp. If hwmon_device_register_with_info() fails right after it, ccp_probe() returns without removing them: the HID core then frees ccp, and ccp_remove() is not called for a failed probe, so the files stay behind. Reading one of them dereferences the freed pointer. Remove the debugfs entries on that error path. debugfs_remove_recursive() waits for readers already inside the show callbacks, so ccp is no longer reachable through debugfs by the time probe returns.
Unified · Split
| @@ -642,13 +642,15 @@ static int ccp_probe(struct hid_device *hdev, const struct hid_device_id *id) · 641 unmodified lines | ||
| 642 | 642 | ccp, &ccp_chip_info, NULL); |
| 643 | 643 | if (IS_ERR(ccp->hwmon_dev)) { |
| 644 | 644 | ret = PTR_ERR(ccp->hwmon_dev); |
| 645 | − goto out_hw_close; | |
| 645 | + goto out_debugfs_remove; | |
| 646 | 646 | } |
| 647 | 647 | |
| 648 | 648 | ccp_debugfs_init(ccp, fw_valid, bl_valid); |
| 649 | 649 | |
| 650 | 650 | return 0; |
| 651 | 651 | |
| 652 | +out_debugfs_remove: | |
| 653 | + debugfs_remove_recursive(ccp->debugfs); | |
| 652 | 654 | out_hw_close: |
| 653 | 655 | hid_hw_close(hdev); |
| 654 | 656 | hid_device_io_stop(hdev); |