Commit 4e44ecb2 authored by Joe Hattori's avatar Joe Hattori Committed by Wen Zhiwei
Browse files

usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in... 

usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error path of .probe()

stable inclusion
from stable-v6.6.72
commit dcd4de31bd01a7189c24e3cafe40649c9c42b9af
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBQN9L

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=dcd4de31bd01a7189c24e3cafe40649c9c42b9af



--------------------------------

commit 74adad500346fb07d69af2c79acbff4adb061134 upstream.

Current implementation of ci_hdrc_imx_driver does not decrement the
refcount of the device obtained in usbmisc_get_init_data(). Add a
put_device() call in .remove() and in .probe() before returning an
error.

This bug was found by an experimental static analysis tool that I am
developing.

Cc: stable <stable@kernel.org>
Fixes: f40017e0 ("chipidea: usbmisc_imx: Add USB support for VF610 SoCs")
Signed-off-by: default avatarJoe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
Acked-by: default avatarPeter Chen <peter.chen@kernel.org>
Link: https://lore.kernel.org/r/20241216015539.352579-1-joe@pf.is.s.u-tokyo.ac.jp


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarWen Zhiwei <wenzhiwei@kylinos.cn>
parent 532d41a2

drivers/usb/chipidea/ci_hdrc_imx.c

+17 −8
Original line number Diff line number Diff line
@@ -362,25 +362,29 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) 
		data->pinctrl = devm_pinctrl_get(dev);

		if (PTR_ERR(data->pinctrl) == -ENODEV)

			data->pinctrl = NULL;

		else if (IS_ERR(data->pinctrl))

			return dev_err_probe(dev, PTR_ERR(data->pinctrl),

		else if (IS_ERR(data->pinctrl)) {

			ret = dev_err_probe(dev, PTR_ERR(data->pinctrl),

					     "pinctrl get failed\n");

			goto err_put;

		}



		data->hsic_pad_regulator =

				devm_regulator_get_optional(dev, "hsic");

		if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) {

			/* no pad regulator is needed */

			data->hsic_pad_regulator = NULL;

		} else if (IS_ERR(data->hsic_pad_regulator))

			return dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),

		} else if (IS_ERR(data->hsic_pad_regulator)) {

			ret = dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),

					     "Get HSIC pad regulator error\n");

			goto err_put;

		}



		if (data->hsic_pad_regulator) {

			ret = regulator_enable(data->hsic_pad_regulator);

			if (ret) {

				dev_err(dev,

					"Failed to enable HSIC pad regulator\n");

				return ret;

				goto err_put;

			}

		}

	}
@@ -394,13 +398,14 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) 
			dev_err(dev,

				"pinctrl_hsic_idle lookup failed, err=%ld\n",

					PTR_ERR(pinctrl_hsic_idle));

			return PTR_ERR(pinctrl_hsic_idle);

			ret = PTR_ERR(pinctrl_hsic_idle);

			goto err_put;

		}



		ret = pinctrl_select_state(data->pinctrl, pinctrl_hsic_idle);

		if (ret) {

			dev_err(dev, "hsic_idle select failed, err=%d\n", ret);

			return ret;

			goto err_put;

		}



		data->pinctrl_hsic_active = pinctrl_lookup_state(data->pinctrl,
@@ -409,7 +414,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) 
			dev_err(dev,

				"pinctrl_hsic_active lookup failed, err=%ld\n",

					PTR_ERR(data->pinctrl_hsic_active));

			return PTR_ERR(data->pinctrl_hsic_active);

			ret = PTR_ERR(data->pinctrl_hsic_active);

			goto err_put;

		}

	}
@@ -513,6 +519,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) 
	if (pdata.flags & CI_HDRC_PMQOS)

		cpu_latency_qos_remove_request(&data->pm_qos_req);

	data->ci_pdev = NULL;

err_put:

	put_device(data->usbmisc_data->dev);

	return ret;

}
@@ -536,6 +544,7 @@ static void ci_hdrc_imx_remove(struct platform_device *pdev) 
		if (data->hsic_pad_regulator)

			regulator_disable(data->hsic_pad_regulator);

	}

	put_device(data->usbmisc_data->dev);

}



static void ci_hdrc_imx_shutdown(struct platform_device *pdev)