mmc: vub300: fix return value check of mmc_add_host()

mmc_add_host() may return error, if we ignore its return value, the memory
that allocated in mmc_alloc_host() will be leaked and it will lead a kernel
crash because of deleting not added device in the remove path.

So fix this by checking the return value and goto error path which will call
mmc_free_host(), besides, the timer added before mmc_add_host() needs be del.

And this patch fixes another missing call mmc_free_host() if usb_control_msg()
fails.

Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20221101063023.1664968-9-yangyingliang@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>

diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
index 97beece62fec4396f28edddf278f126c2de35f76..ab36ec4797478726cfe00da030e6de857778a41a 100644 (file)
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -2299,14 +2299,14 @@ static int vub300_probe(struct usb_interface *interface,
                                0x0000, 0x0000, &vub300->system_port_status,
                                sizeof(vub300->system_port_status), 1000);
        if (retval < 0) {
-               goto error4;
+               goto error5;
        } else if (sizeof(vub300->system_port_status) == retval) {
                vub300->card_present =
                        (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0;
                vub300->read_only =
                        (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0;
        } else {
-               goto error4;
+               goto error5;
        }
        usb_set_intfdata(interface, vub300);
        INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread);
@@ -2329,8 +2329,13 @@ static int vub300_probe(struct usb_interface *interface,
                         "USB vub300 remote SDIO host controller[%d]"
                         "connected with no SD/SDIO card inserted\n",
                         interface_to_InterfaceNumber(interface));
-       mmc_add_host(mmc);
+       retval = mmc_add_host(mmc);
+       if (retval)
+               goto error6;
+
        return 0;
+error6:
+       del_timer_sync(&vub300->inactivity_timer);
 error5:
        mmc_free_host(mmc);
        /*