From: Vladimir Zapolskiy <vz@mleia.com>
To: Johan Hovold <johan@kernel.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Piotr Wojtaszczyk <piotr.wojtaszczyk@timesys.com>,
Alan Stern <stern@rowland.harvard.edu>,
Ma Ke <make24@iscas.ac.cn>,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH v2 1/5] usb: gadget: lpc32xx_udc: fix clock imbalance in error path
Date: Fri, 19 Dec 2025 02:11:41 +0200 [thread overview]
Message-ID: <6355f7da-9b60-4e71-8ea0-da76ed4c0330@mleia.com> (raw)
In-Reply-To: <20251218153519.19453-2-johan@kernel.org>
Hi Johan,
thank you for looking at the issue.
On 12/18/25 17:35, Johan Hovold wrote:
> A recent change fixing a device reference leak introduced a clock
> imbalance by reusing an error path so that the clock may be disabled
> before having been enabled.
>
> Note that the clock framework allows for passing in NULL clocks so there
> is no risk for a NULL pointer dereference.
>
> Also drop the bogus I2C client NULL check added by the offending commit
> as the pointer has already been verified to be non-NULL.
>
> Fixes: c84117912bdd ("USB: lpc32xx_udc: Fix error handling in probe")
This commit didn't get a proper review, and it is broken in so many ways,
that I'd say it has to be reverted.
> Cc: stable@vger.kernel.org
> Cc: Ma Ke <make24@iscas.ac.cn>
> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---
> drivers/usb/gadget/udc/lpc32xx_udc.c | 20 ++++++++++----------
> 1 file changed, 10 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
> index 73c0f28a8585..a962d4294fbe 100644
> --- a/drivers/usb/gadget/udc/lpc32xx_udc.c
> +++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
> @@ -3020,7 +3020,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev)
> pdev->dev.dma_mask = &lpc32xx_usbd_dmamask;
> retval = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
> if (retval)
> - goto i2c_fail;
> + goto err_put_client;
>
> udc->board = &lpc32xx_usbddata;
>
> @@ -3040,7 +3040,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev)
> udc->udp_irq[i] = platform_get_irq(pdev, i);
> if (udc->udp_irq[i] < 0) {
> retval = udc->udp_irq[i];
> - goto i2c_fail;
> + goto err_put_client;
> }
> }
>
> @@ -3048,7 +3048,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev)
> if (IS_ERR(udc->udp_baseaddr)) {
> dev_err(udc->dev, "IO map failure\n");
> retval = PTR_ERR(udc->udp_baseaddr);
> - goto i2c_fail;
> + goto err_put_client;
> }
>
> /* Get USB device clock */
> @@ -3056,14 +3056,14 @@ static int lpc32xx_udc_probe(struct platform_device *pdev)
> if (IS_ERR(udc->usb_slv_clk)) {
> dev_err(udc->dev, "failed to acquire USB device clock\n");
> retval = PTR_ERR(udc->usb_slv_clk);
> - goto i2c_fail;
> + goto err_put_client;
> }
>
> /* Enable USB device clock */
> retval = clk_prepare_enable(udc->usb_slv_clk);
> if (retval < 0) {
> dev_err(udc->dev, "failed to start USB device clock\n");
> - goto i2c_fail;
> + goto err_put_client;
> }
>
> /* Setup deferred workqueue data */
> @@ -3165,9 +3165,10 @@ static int lpc32xx_udc_probe(struct platform_device *pdev)
> dma_free_coherent(&pdev->dev, UDCA_BUFF_SIZE,
> udc->udca_v_base, udc->udca_p_base);
> i2c_fail:
> - if (udc->isp1301_i2c_client)
> - put_device(&udc->isp1301_i2c_client->dev);
> clk_disable_unprepare(udc->usb_slv_clk);
> +err_put_client:
> + put_device(&udc->isp1301_i2c_client->dev);
> +
> dev_err(udc->dev, "%s probe failed, %d\n", driver_name, retval);
>
> return retval;
> @@ -3195,10 +3196,9 @@ static void lpc32xx_udc_remove(struct platform_device *pdev)
> dma_free_coherent(&pdev->dev, UDCA_BUFF_SIZE,
> udc->udca_v_base, udc->udca_p_base);
>
> - if (udc->isp1301_i2c_client)
> - put_device(&udc->isp1301_i2c_client->dev);
> -
> clk_disable_unprepare(udc->usb_slv_clk);
> +
> + put_device(&udc->isp1301_i2c_client->dev);
> }
>
> #ifdef CONFIG_PM
Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
--
Best wishes,
Vladimir
next prev parent reply other threads:[~2025-12-19 0:11 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-18 15:35 [PATCH v2 0/5] USB: lpc32xx: fix error handling Johan Hovold
2025-12-18 15:35 ` [PATCH v2 1/5] usb: gadget: lpc32xx_udc: fix clock imbalance in error path Johan Hovold
2025-12-19 0:11 ` Vladimir Zapolskiy [this message]
2025-12-18 15:35 ` [PATCH v2 2/5] usb: phy: isp1301: fix non-OF device reference imbalance Johan Hovold
2025-12-19 0:15 ` Vladimir Zapolskiy
2025-12-19 6:20 ` Johan Hovold
2025-12-18 15:35 ` [PATCH v2 3/5] usb: ohci-nxp: fix device leak on probe failure Johan Hovold
2025-12-18 15:52 ` Alan Stern
2025-12-19 0:19 ` Vladimir Zapolskiy
2025-12-18 15:35 ` [PATCH v2 4/5] usb: gadget: lpc32xx_udc: clean up probe error labels Johan Hovold
2025-12-19 0:22 ` Vladimir Zapolskiy
2025-12-18 15:35 ` [PATCH v2 5/5] usb: ohci-nxp: " Johan Hovold
2025-12-19 0:22 ` Vladimir Zapolskiy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6355f7da-9b60-4e71-8ea0-da76ed4c0330@mleia.com \
--to=vz@mleia.com \
--cc=gregkh@linuxfoundation.org \
--cc=johan@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=make24@iscas.ac.cn \
--cc=piotr.wojtaszczyk@timesys.com \
--cc=stable@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.