| Message ID | 20241212094945.3784866-1-joe@pf.is.s.u-tokyo.ac.jp |
|---|---|
| State | New |
| Headers | show |
| Series | usb: chipidea: ci_hdrc_imx: decrement device's refcount on the error path of .probe() | expand |
On 24-12-12 18:49:45, Joe Hattori wrote: > Current implementation of ci_hdrc_imx_probe() does not decrement the > refcount of the device obtained in usbmisc_get_init_data(). Add a > put_device() call before returning an error after the call. > > This bug was found by an experimental static analysis tool that I am > developing. > > Cc: stable@vger.kernel.org > Fixes: f40017e0f332 ("chipidea: usbmisc_imx: Add USB support for VF610 SoCs") > Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> > --- > drivers/usb/chipidea/ci_hdrc_imx.c | 24 ++++++++++++++++-------- > 1 file changed, 16 insertions(+), 8 deletions(-) > > diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c > index f2801700be8e..6418052264f2 100644 > --- a/drivers/usb/chipidea/ci_hdrc_imx.c > +++ b/drivers/usb/chipidea/ci_hdrc_imx.c > @@ -370,25 +370,29 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) > data->pinctrl = devm_pinctrl_get(dev); > if (PTR_ERR(data->pinctrl) == -ENODEV) > data->pinctrl = NULL; > - else if (IS_ERR(data->pinctrl)) > - return dev_err_probe(dev, PTR_ERR(data->pinctrl), > + else if (IS_ERR(data->pinctrl)) { > + ret = dev_err_probe(dev, PTR_ERR(data->pinctrl), > "pinctrl get failed\n"); > + goto err_put; > + } > > data->hsic_pad_regulator = > devm_regulator_get_optional(dev, "hsic"); > if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) { > /* no pad regulator is needed */ > data->hsic_pad_regulator = NULL; > - } else if (IS_ERR(data->hsic_pad_regulator)) > - return dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator), > + } else if (IS_ERR(data->hsic_pad_regulator)) { > + ret = dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator), > "Get HSIC pad regulator error\n"); > + goto err_put; > + } > > if (data->hsic_pad_regulator) { > ret = regulator_enable(data->hsic_pad_regulator); > if (ret) { > dev_err(dev, > "Failed to enable HSIC pad regulator\n"); > - return ret; > + goto err_put; > } > } > } > @@ -402,13 +406,14 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) > dev_err(dev, > "pinctrl_hsic_idle lookup failed, err=%ld\n", > PTR_ERR(pinctrl_hsic_idle)); > - return PTR_ERR(pinctrl_hsic_idle); > + ret = PTR_ERR(pinctrl_hsic_idle); > + goto err_put; > } > > ret = pinctrl_select_state(data->pinctrl, pinctrl_hsic_idle); > if (ret) { > dev_err(dev, "hsic_idle select failed, err=%d\n", ret); > - return ret; > + goto err_put; > } > > data->pinctrl_hsic_active = pinctrl_lookup_state(data->pinctrl, > @@ -417,7 +422,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) > dev_err(dev, > "pinctrl_hsic_active lookup failed, err=%ld\n", > PTR_ERR(data->pinctrl_hsic_active)); > - return PTR_ERR(data->pinctrl_hsic_active); > + ret = PTR_ERR(data->pinctrl_hsic_active); > + goto err_put; > } > } > > @@ -527,6 +533,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) > if (pdata.flags & CI_HDRC_PMQOS) > cpu_latency_qos_remove_request(&data->pm_qos_req); > data->ci_pdev = NULL; > +err_put: > + put_device(data->usbmisc_data->dev); > return ret; > } > Thanks for your fix, would you mind also add put_device at the end of ci_hdrc_imx_remove? Peter
Hi Peter, Thank you for your review. On 12/16/24 10:29, Peter Chen wrote: > On 24-12-12 18:49:45, Joe Hattori wrote: >> Current implementation of ci_hdrc_imx_probe() does not decrement the >> refcount of the device obtained in usbmisc_get_init_data(). Add a >> put_device() call before returning an error after the call. >> >> This bug was found by an experimental static analysis tool that I am >> developing. >> >> Cc: stable@vger.kernel.org >> Fixes: f40017e0f332 ("chipidea: usbmisc_imx: Add USB support for VF610 SoCs") >> Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> >> --- >> drivers/usb/chipidea/ci_hdrc_imx.c | 24 ++++++++++++++++-------- >> 1 file changed, 16 insertions(+), 8 deletions(-) >> >> diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c >> index f2801700be8e..6418052264f2 100644 >> --- a/drivers/usb/chipidea/ci_hdrc_imx.c >> +++ b/drivers/usb/chipidea/ci_hdrc_imx.c >> @@ -370,25 +370,29 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) >> data->pinctrl = devm_pinctrl_get(dev); >> if (PTR_ERR(data->pinctrl) == -ENODEV) >> data->pinctrl = NULL; >> - else if (IS_ERR(data->pinctrl)) >> - return dev_err_probe(dev, PTR_ERR(data->pinctrl), >> + else if (IS_ERR(data->pinctrl)) { >> + ret = dev_err_probe(dev, PTR_ERR(data->pinctrl), >> "pinctrl get failed\n"); >> + goto err_put; >> + } >> >> data->hsic_pad_regulator = >> devm_regulator_get_optional(dev, "hsic"); >> if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) { >> /* no pad regulator is needed */ >> data->hsic_pad_regulator = NULL; >> - } else if (IS_ERR(data->hsic_pad_regulator)) >> - return dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator), >> + } else if (IS_ERR(data->hsic_pad_regulator)) { >> + ret = dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator), >> "Get HSIC pad regulator error\n"); >> + goto err_put; >> + } >> >> if (data->hsic_pad_regulator) { >> ret = regulator_enable(data->hsic_pad_regulator); >> if (ret) { >> dev_err(dev, >> "Failed to enable HSIC pad regulator\n"); >> - return ret; >> + goto err_put; >> } >> } >> } >> @@ -402,13 +406,14 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) >> dev_err(dev, >> "pinctrl_hsic_idle lookup failed, err=%ld\n", >> PTR_ERR(pinctrl_hsic_idle)); >> - return PTR_ERR(pinctrl_hsic_idle); >> + ret = PTR_ERR(pinctrl_hsic_idle); >> + goto err_put; >> } >> >> ret = pinctrl_select_state(data->pinctrl, pinctrl_hsic_idle); >> if (ret) { >> dev_err(dev, "hsic_idle select failed, err=%d\n", ret); >> - return ret; >> + goto err_put; >> } >> >> data->pinctrl_hsic_active = pinctrl_lookup_state(data->pinctrl, >> @@ -417,7 +422,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) >> dev_err(dev, >> "pinctrl_hsic_active lookup failed, err=%ld\n", >> PTR_ERR(data->pinctrl_hsic_active)); >> - return PTR_ERR(data->pinctrl_hsic_active); >> + ret = PTR_ERR(data->pinctrl_hsic_active); >> + goto err_put; >> } >> } >> >> @@ -527,6 +533,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) >> if (pdata.flags & CI_HDRC_PMQOS) >> cpu_latency_qos_remove_request(&data->pm_qos_req); >> data->ci_pdev = NULL; >> +err_put: >> + put_device(data->usbmisc_data->dev); >> return ret; >> } >> > > Thanks for your fix, would you mind also add put_device at the end of > ci_hdrc_imx_remove? Thank you for pointing out. Fixed in the v2 patch. > > Peter Best, joe
diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c index f2801700be8e..6418052264f2 100644 --- a/drivers/usb/chipidea/ci_hdrc_imx.c +++ b/drivers/usb/chipidea/ci_hdrc_imx.c @@ -370,25 +370,29 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) data->pinctrl = devm_pinctrl_get(dev); if (PTR_ERR(data->pinctrl) == -ENODEV) data->pinctrl = NULL; - else if (IS_ERR(data->pinctrl)) - return dev_err_probe(dev, PTR_ERR(data->pinctrl), + else if (IS_ERR(data->pinctrl)) { + ret = dev_err_probe(dev, PTR_ERR(data->pinctrl), "pinctrl get failed\n"); + goto err_put; + } data->hsic_pad_regulator = devm_regulator_get_optional(dev, "hsic"); if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) { /* no pad regulator is needed */ data->hsic_pad_regulator = NULL; - } else if (IS_ERR(data->hsic_pad_regulator)) - return dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator), + } else if (IS_ERR(data->hsic_pad_regulator)) { + ret = dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator), "Get HSIC pad regulator error\n"); + goto err_put; + } if (data->hsic_pad_regulator) { ret = regulator_enable(data->hsic_pad_regulator); if (ret) { dev_err(dev, "Failed to enable HSIC pad regulator\n"); - return ret; + goto err_put; } } } @@ -402,13 +406,14 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) dev_err(dev, "pinctrl_hsic_idle lookup failed, err=%ld\n", PTR_ERR(pinctrl_hsic_idle)); - return PTR_ERR(pinctrl_hsic_idle); + ret = PTR_ERR(pinctrl_hsic_idle); + goto err_put; } ret = pinctrl_select_state(data->pinctrl, pinctrl_hsic_idle); if (ret) { dev_err(dev, "hsic_idle select failed, err=%d\n", ret); - return ret; + goto err_put; } data->pinctrl_hsic_active = pinctrl_lookup_state(data->pinctrl, @@ -417,7 +422,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) dev_err(dev, "pinctrl_hsic_active lookup failed, err=%ld\n", PTR_ERR(data->pinctrl_hsic_active)); - return PTR_ERR(data->pinctrl_hsic_active); + ret = PTR_ERR(data->pinctrl_hsic_active); + goto err_put; } } @@ -527,6 +533,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) if (pdata.flags & CI_HDRC_PMQOS) cpu_latency_qos_remove_request(&data->pm_qos_req); data->ci_pdev = NULL; +err_put: + put_device(data->usbmisc_data->dev); return ret; }
Current implementation of ci_hdrc_imx_probe() does not decrement the refcount of the device obtained in usbmisc_get_init_data(). Add a put_device() call before returning an error after the call. This bug was found by an experimental static analysis tool that I am developing. Cc: stable@vger.kernel.org Fixes: f40017e0f332 ("chipidea: usbmisc_imx: Add USB support for VF610 SoCs") Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> --- drivers/usb/chipidea/ci_hdrc_imx.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-)