USB: apple-mfi-fastcharge: Fix use after free in probe

This code frees "mfi" and then derefences it on the next line to get
the error code.

Fixes: b0eec52fbe63 ("USB: apple-mfi-fastcharge: Fix kfree after failed kzalloc")
Reviewed-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X8ik4j8yJitVUyfU@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/misc/apple-mfi-fastcharge.c b/drivers/usb/misc/apple-mfi-fastcharge.c
index 6dedd5498e8a414fb2a5d74175b04d9eee69f958..ac8695195c13c8752076e4391ac81a9da3780c44 100644 (file)
--- a/drivers/usb/misc/apple-mfi-fastcharge.c
+++ b/drivers/usb/misc/apple-mfi-fastcharge.c
@@ -178,6 +178,7 @@ static int mfi_fc_probe(struct usb_device *udev)
 {
        struct power_supply_config battery_cfg = {};
        struct mfi_device *mfi = NULL;
+       int err;
 
        if (!mfi_fc_match(udev))
                return -ENODEV;
@@ -194,8 +195,9 @@ static int mfi_fc_probe(struct usb_device *udev)
                                                &battery_cfg);
        if (IS_ERR(mfi->battery)) {
                dev_err(&udev->dev, "Can't register battery\n");
+               err = PTR_ERR(mfi->battery);
                kfree(mfi);
-               return PTR_ERR(mfi->battery);
+               return err;
        }
 
        mfi->udev = usb_get_dev(udev);