[PATCH] usb: musb-new: mt85xx: Free the controller if the host probe fails

[PATCH] usb: musb-new: mt85xx: Free the controller if the host probe fails

[Yuho Choi]

In host mode, musb_usb_probe() allocates the struct musb with
musb_init_controller() and returns the error when musb_lowlevel_init()
fails, for example when no device is connected. The struct musb is not
freed on this path, and the driver core then frees the private data that
holds the only pointer to it. Each 'usb reset', or 'usb start' after
'usb stop', probes the controller again and leaks another one.

Free the struct musb when musb_lowlevel_init() fails.

Fixes: 7d017d607eaa ("usb: musb-new: mt85xx: add musb-new gadget driver.")
Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
---
Build-tested only, with mt8518_ap1_emmc_defconfig and
CONFIG_USB_MUSB_HOST=y.

 drivers/usb/musb-new/mt85xx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/musb-new/mt85xx.c b/drivers/usb/musb-new/mt85xx.c
index 14b28bbae6b..2e13b2a30d8 100644
--- a/drivers/usb/musb-new/mt85xx.c
+++ b/drivers/usb/musb-new/mt85xx.c
@@ -365,6 +365,8 @@ static int musb_usb_probe(struct udevice *dev)
 	ret = musb_lowlevel_init(host);
 	if (!ret)
 		printf("MTK MUSB OTG (Host)\n");
+	else
+		free(host->host);
 #else
 	pdata.mode = MUSB_PERIPHERAL;
 	host->host = musb_register(&pdata, &glue->dev, base);

base-commit: feb8913982e4462c01fd914271f92254a25dc101
-- 
2.43.0

Re: [PATCH] usb: musb-new: mt85xx: Free the controller if the host probe fails

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 1605 bytes --]

On Fri, Nov 06, 2026 at 02:37:52PM -0500, Yuho Choi wrote:

> In host mode, musb_usb_probe() allocates the struct musb with
> musb_init_controller() and returns the error when musb_lowlevel_init()
> fails, for example when no device is connected. The struct musb is not
> freed on this path, and the driver core then frees the private data that
> holds the only pointer to it. Each 'usb reset', or 'usb start' after
> 'usb stop', probes the controller again and leaks another one.
> 
> Free the struct musb when musb_lowlevel_init() fails.
> 
> Fixes: 7d017d607eaa ("usb: musb-new: mt85xx: add musb-new gadget driver.")
> Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
> ---
> Build-tested only, with mt8518_ap1_emmc_defconfig and
> CONFIG_USB_MUSB_HOST=y.
> 
>  drivers/usb/musb-new/mt85xx.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/musb-new/mt85xx.c b/drivers/usb/musb-new/mt85xx.c
> index 14b28bbae6b..2e13b2a30d8 100644
> --- a/drivers/usb/musb-new/mt85xx.c
> +++ b/drivers/usb/musb-new/mt85xx.c
> @@ -365,6 +365,8 @@ static int musb_usb_probe(struct udevice *dev)
>  	ret = musb_lowlevel_init(host);
>  	if (!ret)
>  		printf("MTK MUSB OTG (Host)\n");
> +	else
> +		free(host->host);
>  #else
>  	pdata.mode = MUSB_PERIPHERAL;
>  	host->host = musb_register(&pdata, &glue->dev, base);

As your test notes, nothing builds like this normally today. And in the
failure case we have more to worry about than just a resource leak. We
shouldn't bother doing this until someone is going to handle the error
case correctly.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]