public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error path of .probe()

Browse source 
Current implementation of ci_hdrc_imx_driver does not decrement the
refcount of the device obtained in usbmisc_get_init_data(). Add a
put_device() call in .remove() and in .probe() before returning an
error.

This bug was found by an experimental static analysis tool that I am
developing.

Cc: stable <stable@kernel.org>
Fixes: f40017e0f3 ("chipidea: usbmisc_imx: Add USB support for VF610 SoCs")
Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://lore.kernel.org/r/20241216015539.352579-1-joe@pf.is.s.u-tokyo.ac.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Joe Hattori 2024-12-16 10:55:39 +09:00 • committed by Greg Kroah-Hartman
parent f47eba045e
commit 74adad5003
1 changed files with 17 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
drivers/usb/chipidea/ci_hdrc_imx.c
View file

@ -370,25 +370,29 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
data->pinctrl = devm_pinctrl_get(dev); data->pinctrl = devm_pinctrl_get(dev);
if (PTR_ERR(data->pinctrl) == -ENODEV) if (PTR_ERR(data->pinctrl) == -ENODEV)
data->pinctrl = NULL; data->pinctrl = NULL;
else if (IS_ERR(data->pinctrl)) else if (IS_ERR(data->pinctrl)) {
return dev_err_probe(dev, PTR_ERR(data->pinctrl), ret = dev_err_probe(dev, PTR_ERR(data->pinctrl),
"pinctrl get failed\n"); "pinctrl get failed\n");
goto err_put;
}
data->hsic_pad_regulator = data->hsic_pad_regulator =
devm_regulator_get_optional(dev, "hsic"); devm_regulator_get_optional(dev, "hsic");
if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) { if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) {
/* no pad regulator is needed */ /* no pad regulator is needed */
data->hsic_pad_regulator = NULL; data->hsic_pad_regulator = NULL;
} else if (IS_ERR(data->hsic_pad_regulator)) } else if (IS_ERR(data->hsic_pad_regulator)) {
return dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator), ret = dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
"Get HSIC pad regulator error\n"); "Get HSIC pad regulator error\n");
goto err_put;
}
if (data->hsic_pad_regulator) { if (data->hsic_pad_regulator) {
ret = regulator_enable(data->hsic_pad_regulator); ret = regulator_enable(data->hsic_pad_regulator);
if (ret) { if (ret) {
dev_err(dev, dev_err(dev,
"Failed to enable HSIC pad regulator\n"); "Failed to enable HSIC pad regulator\n");
return ret; goto err_put;
} }
} }
} }
@ -402,13 +406,14 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
dev_err(dev, dev_err(dev,
"pinctrl_hsic_idle lookup failed, err=%ld\n", "pinctrl_hsic_idle lookup failed, err=%ld\n",
PTR_ERR(pinctrl_hsic_idle)); PTR_ERR(pinctrl_hsic_idle));
return PTR_ERR(pinctrl_hsic_idle); ret = PTR_ERR(pinctrl_hsic_idle);
goto err_put;
} }
ret = pinctrl_select_state(data->pinctrl, pinctrl_hsic_idle); ret = pinctrl_select_state(data->pinctrl, pinctrl_hsic_idle);
if (ret) { if (ret) {
dev_err(dev, "hsic_idle select failed, err=%d\n", ret); dev_err(dev, "hsic_idle select failed, err=%d\n", ret);
return ret; goto err_put;
} }
data->pinctrl_hsic_active = pinctrl_lookup_state(data->pinctrl, data->pinctrl_hsic_active = pinctrl_lookup_state(data->pinctrl,
@ -417,7 +422,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
dev_err(dev, dev_err(dev,
"pinctrl_hsic_active lookup failed, err=%ld\n", "pinctrl_hsic_active lookup failed, err=%ld\n",
PTR_ERR(data->pinctrl_hsic_active)); PTR_ERR(data->pinctrl_hsic_active));
return PTR_ERR(data->pinctrl_hsic_active); ret = PTR_ERR(data->pinctrl_hsic_active);
goto err_put;
} }
} }
@ -527,6 +533,8 @@ disable_hsic_regulator:
if (pdata.flags & CI_HDRC_PMQOS) if (pdata.flags & CI_HDRC_PMQOS)
cpu_latency_qos_remove_request(&data->pm_qos_req); cpu_latency_qos_remove_request(&data->pm_qos_req);
data->ci_pdev = NULL; data->ci_pdev = NULL;
err_put:
put_device(data->usbmisc_data->dev);
return ret; return ret;
} }
@ -551,6 +559,7 @@ static void ci_hdrc_imx_remove(struct platform_device *pdev)
if (data->hsic_pad_regulator) if (data->hsic_pad_regulator)
regulator_disable(data->hsic_pad_regulator); regulator_disable(data->hsic_pad_regulator);
} }
put_device(data->usbmisc_data->dev);
} }
static void ci_hdrc_imx_shutdown(struct platform_device *pdev) static void ci_hdrc_imx_shutdown(struct platform_device *pdev)