[RFC PATCH 6.6.y 1/4] misc: ti-st: publish the transport only after probe succeeds

[Hongyan Xu]

kim_probe() stores the platform device in st_kim_devices[] before the
transport core and the remaining resources are initialized.  If a later
probe step fails, st_kim_ref() can follow that published device to freed
driver data.

Publish the device only after probe has completed, and clear drvdata when
rolling probe back.

Fixes: 53618cc1e51e ("Staging: sources for ST core")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Hongyan Xu <getshell@xxxxxxxxxx>
---
 drivers/misc/ti-st/st_kim.c | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
index fe682e0..ec265a6 100644
--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -699,15 +699,7 @@ static int kim_probe(struct platform_device *pdev)
 {
 	struct kim_data_s	*kim_gdata;
 	struct ti_st_plat_data	*pdata = pdev->dev.platform_data;
-	int err;
-
-	if ((pdev->id != -1) && (pdev->id < MAX_ST_DEVICES)) {
-		/* multiple devices could exist */
-		st_kim_devices[pdev->id] = pdev;
-	} else {
-		/* platform's sure about existence of 1 device */
-		st_kim_devices[0] = pdev;
-	}
+	int err, id = 0;
 
 	kim_gdata = kzalloc(sizeof(struct kim_data_s), GFP_KERNEL);
 	if (!kim_gdata) {
@@ -762,12 +754,16 @@ static int kim_probe(struct platform_device *pdev)
 				kim_gdata, &version_fops);
 	debugfs_create_file("protocols", S_IRUGO, kim_debugfs_dir,
 				kim_gdata, &list_fops);
+	if (pdev->id >= 0 && pdev->id < MAX_ST_DEVICES)
+		id = pdev->id;
+	st_kim_devices[id] = pdev;
 	return 0;
 
 err_sysfs_group:
 	st_core_exit(kim_gdata->core_data);
 
 err_core_init:
+	platform_set_drvdata(pdev, NULL);
 	kfree(kim_gdata);
 
 	return err;
-- 
2.50.1.windows.1