From nobody Sat Feb 7 08:13:17 2026 Received: from cae.in-ulm.de (cae.in-ulm.de [217.10.14.231]) by smtp.subspace.kernel.org (Postfix) with ESMTP id C15EE15AF8 for ; Tue, 2 Jan 2024 19:30:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=c--e.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=c--e.de Received: by cae.in-ulm.de (Postfix, from userid 1000) id 89F801408EF; Tue, 2 Jan 2024 20:30:37 +0100 (CET) From: "Christian A. Ehrhardt" To: linux-kernel@vger.kernel.org Cc: "Christian A. Ehrhardt" , Chris Bainbridge , RD Babiera , Heikki Krogerus , Greg Kroah-Hartman Subject: [PATCH] usb: typec: Fix double free in typec_altmode_put_partner Date: Tue, 2 Jan 2024 20:29:48 +0100 Message-Id: <20240102192948.42392-1-lk@c--e.de> X-Mailer: git-send-email 2.30.2 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The altmode device nodes of a port partner and of cable plugs hold a reference to the altmode of a port. The port's altmode contains various back pointers but these do not contribute to the reference count. Thus, free the port's altmode device instead of doing a double free on ourself. Reported-By: Chris Bainbridge Fixes: b17b7fe6dd5c (usb: typec: class: fix typec_altmode_put_partner to pu= t plugs) Cc: RD Babiera Cc: Heikki Krogerus Cc: Greg Kroah-Hartman Cc: stable@vger.kernel.org Signed-off-by: Christian A. Ehrhardt Tested-by: RD Babiera --- drivers/usb/typec/class.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c index 16a670828dde..2da19feacd91 100644 --- a/drivers/usb/typec/class.c +++ b/drivers/usb/typec/class.c @@ -263,11 +263,13 @@ static void typec_altmode_put_partner(struct altmode = *altmode) { struct altmode *partner =3D altmode->partner; struct typec_altmode *adev; + struct typec_altmode *partner_adev; =20 if (!partner) return; =20 adev =3D &altmode->adev; + partner_adev =3D &partner->adev; =20 if (is_typec_plug(adev->dev.parent)) { struct typec_plug *plug =3D to_typec_plug(adev->dev.parent); @@ -276,7 +278,7 @@ static void typec_altmode_put_partner(struct altmode *a= ltmode) } else { partner->partner =3D NULL; } - put_device(&adev->dev); + put_device(&partner_adev->dev); } =20 /** --=20 2.40.1