Re: [PATCH v2] USB: misc: uss720: unregister parport on probe failure

[Alex Henrie]

On Mon, Jul 6, 2026 at 9:11 AM Myeonghun Pak <mhun512@xxxxxxxxx> wrote:
>
> uss720_probe() registers a parport before reading the 1284 register used
> to detect unsupported Belkin F5U002 adapters. If get_1284_register()
> fails, the error path drops the driver private data and the USB device
> reference, but leaves the parport device registered.
>
> Leaving the port registered is more than a private allocation leak:
> parport_register_port() has already reserved a parport number and
> registered the parport bus device, while pp->private_data still points at
> the private data that the common error path is about to release.
>
> Undo the pre-announce registration in the get_1284_register() failure
> branch before jumping to the common private-data cleanup path. Clear
> priv->pp first, matching the disconnect path and avoiding a stale pointer
> in the private data.
>
> This issue was identified during our ongoing static-analysis research while
> reviewing kernel code.
>
> Fixes: 3295f1b866bf ("usb: misc: uss720: check for incompatible versions of the Belkin F5U002")
> Cc: stable@xxxxxxxxxxxxxxx
> Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
> Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
> Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>
> ---
> Changes in v2:
> - Move the parport cleanup to the get_1284_register() failure branch,
>   as suggested by Alex.
> - Clarify the visible stale registered-port effect.
>
>  drivers/usb/misc/uss720.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
> index a8af7615b1..bd099cd8c5 100644
> --- a/drivers/usb/misc/uss720.c
> +++ b/drivers/usb/misc/uss720.c
> @@ -735,8 +735,11 @@ static int uss720_probe(struct usb_interface *intf,
>          * here. */
>         ret = get_1284_register(pp, 0, &reg, GFP_KERNEL);
>         dev_dbg(&intf->dev, "reg: %7ph\n", priv->reg);
> -       if (ret < 0)
> +       if (ret < 0) {
> +               priv->pp = NULL;
> +               parport_del_port(pp);
>                 goto probe_abort;
> +       }
>
>         ret = usb_find_last_int_in_endpoint(interface, &epd);
>         if (!ret) {
> --
> 2.47.1

Reviewed-by: Alex Henrie <alexhenrie24@xxxxxxxxx>