On 24-12-16 10:55:39, Joe Hattori wrote:

Current implementation of ci_hdrc_imx_driver does not decrement the refcount of the device obtained in usbmisc_get_init_data(). Add a put_device() call in .remove() and in .probe() before returning an error.

This bug was found by an experimental static analysis tool that I am developing.

Cc: stable@vger.kernel.org Fixes: f40017e0f332 ("chipidea: usbmisc_imx: Add USB support for VF610 SoCs") Signed-off-by: Joe Hattori joe@pf.is.s.u-tokyo.ac.jp

Acked-by: Peter Chen peter.chen@kernel.org

---

Changes in v2:

• Put the device in .remove() as well.

---

drivers/usb/chipidea/ci_hdrc_imx.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c index f2801700be8e..1a7fc638213e 100644 --- a/drivers/usb/chipidea/ci_hdrc_imx.c +++ b/drivers/usb/chipidea/ci_hdrc_imx.c @@ -370,25 +370,29 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) data->pinctrl = devm_pinctrl_get(dev); if (PTR_ERR(data->pinctrl) == -ENODEV) data->pinctrl = NULL;

• else if (IS_ERR(data->pinctrl))
  

• 	return dev_err_probe(dev, PTR_ERR(data->pinctrl),
  

• else if (IS_ERR(data->pinctrl)) {
  

• 	ret = dev_err_probe(dev, PTR_ERR(data->pinctrl),
  		     "pinctrl get failed\n");
  

• 	goto err_put;
  

• }
  

data->hsic_pad_regulator = devm_regulator_get_optional(dev, "hsic"); if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) { /* no pad regulator is needed */ data->hsic_pad_regulator = NULL;

• } else if (IS_ERR(data->hsic_pad_regulator))
  

• 	return dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
  

• } else if (IS_ERR(data->hsic_pad_regulator)) {
  

• 	ret = dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
  		     "Get HSIC pad regulator error\n");
  

• 	goto err_put;
  

• }
  

if (data->hsic_pad_regulator) { ret = regulator_enable(data->hsic_pad_regulator); if (ret) { dev_err(dev, "Failed to enable HSIC pad regulator\n");

• 		return ret;
  

• 		goto err_put;
  }
  

  } }

@@ -402,13 +406,14 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) dev_err(dev, "pinctrl_hsic_idle lookup failed, err=%ld\n", PTR_ERR(pinctrl_hsic_idle));

• 	return PTR_ERR(pinctrl_hsic_idle);
  

• 	ret = PTR_ERR(pinctrl_hsic_idle);
  

• 	goto err_put;
  

  }

ret = pinctrl_select_state(data->pinctrl, pinctrl_hsic_idle); if (ret) { dev_err(dev, "hsic_idle select failed, err=%d\n", ret);

• 	return ret;
  

• 	goto err_put;
  

  }

data->pinctrl_hsic_active = pinctrl_lookup_state(data->pinctrl, @@ -417,7 +422,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) dev_err(dev, "pinctrl_hsic_active lookup failed, err=%ld\n", PTR_ERR(data->pinctrl_hsic_active));

• 	return PTR_ERR(data->pinctrl_hsic_active);
  

• 	ret = PTR_ERR(data->pinctrl_hsic_active);
  

• 	goto err_put;
  

  } }

@@ -527,6 +533,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) if (pdata.flags & CI_HDRC_PMQOS) cpu_latency_qos_remove_request(&data->pm_qos_req); data->ci_pdev = NULL; +err_put:

• put_device(data->usbmisc_data->dev); return ret;

} @@ -551,6 +559,7 @@ static void ci_hdrc_imx_remove(struct platform_device *pdev) if (data->hsic_pad_regulator) regulator_disable(data->hsic_pad_regulator); }

• put_device(data->usbmisc_data->dev);

} static void ci_hdrc_imx_shutdown(struct platform_device *pdev) -- 2.34.1