Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug

The qmp_usb_iomap() helper function currently returns the raw result of
devm_ioremap() for non-exclusive mappings. Since devm_ioremap() may return
a NULL pointer and the caller only checks error pointers with IS_ERR(),
NULL could bypass the check and lead to an invalid dereference.

Fix the issue by checking if devm_ioremap() returns NULL. When it does,
qmp_usb_iomap() now returns an error pointer via IOMEM_ERR_PTR(-ENOMEM),
ensuring safe and consistent error handling.

Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
Fixes: a5d6b1ac56cb ("phy: qcom-qmp-usb: fix memleak on probe deferral")
CC: Johan Hovold <johan@kernel.org>
CC: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250414125050.2118619-1-chenyuan0y@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>

authored by

Chenyuan Yang and committed by
Vinod Koul
d14402a3 e00c9aea

+5 -1
+5 -1
drivers/phy/qualcomm/phy-qcom-qmp-usb.c
··· 2106 2106 int index, bool exclusive) 2107 2107 { 2108 2108 struct resource res; 2109 + void __iomem *mem; 2109 2110 2110 2111 if (!exclusive) { 2111 2112 if (of_address_to_resource(np, index, &res)) 2112 2113 return IOMEM_ERR_PTR(-EINVAL); 2113 2114 2114 - return devm_ioremap(dev, res.start, resource_size(&res)); 2115 + mem = devm_ioremap(dev, res.start, resource_size(&res)); 2116 + if (!mem) 2117 + return IOMEM_ERR_PTR(-ENOMEM); 2118 + return mem; 2115 2119 } 2116 2120 2117 2121 return devm_of_iomap(dev, np, index, NULL);