ccp_debugfs_init() registers debugfs files whose private data is the devm allocated ccp. If hwmon_device_register_with_info() fails right after it, ccp_probe() returns without removing them: the HID core then frees ccp, and ccp_remove() is not called for a failed probe, so the files stay behind. Reading one of them dereferences the freed pointer. Remove the debugfs entries on that error path. debugfs_remove_recursive() waits for readers already inside the show callbacks, so ccp is no longer reachable through debugfs by the time probe returns.
Unified · Split
| @@ -642,13 +642,15 @@ static int ccp_probe(struct hid_device *hdev, const struct hid_device_id *id) · 641 unmodified lines | |||
| 642 | ccp, &ccp_chip_info, NULL); | 642 | ccp, &ccp_chip_info, NULL); |
| 643 | if (IS_ERR(ccp->hwmon_dev)) { | 643 | if (IS_ERR(ccp->hwmon_dev)) { |
| 644 | ret = PTR_ERR(ccp->hwmon_dev); | 644 | ret = PTR_ERR(ccp->hwmon_dev); |
| 645 | goto out_hw_close; | 645 | goto out_debugfs_remove; |
| 646 | } | 646 | } |
| 647 | 647 | ||
| 648 | ccp_debugfs_init(ccp, fw_valid, bl_valid); | 648 | ccp_debugfs_init(ccp, fw_valid, bl_valid); |
| 649 | 649 | ||
| 650 | return 0; | 650 | return 0; |
| 651 | 651 | ||
| 652 | out_debugfs_remove: | ||
| 653 | debugfs_remove_recursive(ccp->debugfs); | ||
| 652 | out_hw_close: | 654 | out_hw_close: |
| 653 | hid_hw_close(hdev); | 655 | hid_hw_close(hdev); |
| 654 | hid_device_io_stop(hdev); | 656 | hid_device_io_stop(hdev); |