[PATCH] usb: musb: omap2430: Do not put borrowed of_node in probe

[PATCH] usb: musb: omap2430: Do not put borrowed of_node in probe

[Guangshuo Li]

omap2430_probe() stores pdev->dev.of_node in a local np variable. This is
a borrowed pointer and the probe function does not take a reference to
it.

The success and error paths nevertheless call of_node_put(np). This drops
a reference that is owned by the platform device, and can leave
pdev->dev.of_node with an unbalanced reference count.

Do not put the borrowed platform device node from omap2430_probe().
References taken for the child MUSB device are handled by the device core,
and the ctrl-module phandle reference is still released separately.

Fixes: e194ce048f5a ("usb: musb: omap2430: Fix use-after-free in omap2430_probe()")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/usb/musb/omap2430.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 333ab79f0ca9..6e749faac33c 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -454,7 +454,6 @@ static int omap2430_probe(struct platform_device *pdev)
 		dev_err(&pdev->dev, "failed to register musb device\n");
 		goto err_disable_rpm;
 	}
-	of_node_put(np);
 
 	return 0;
 
@@ -464,7 +463,6 @@ static int omap2430_probe(struct platform_device *pdev)
 	if (!IS_ERR(glue->control_otghs))
 		put_device(glue->control_otghs);
 err_put_musb:
-	of_node_put(np);
 	platform_device_put(musb);
 
 	return ret;
-- 
2.43.0

Re: [PATCH] usb: musb: omap2430: Do not put borrowed of_node in probe

[Johan Hovold]

On Sun, Jul 05, 2026 at 05:14:11PM +0800, Guangshuo Li wrote:
> omap2430_probe() stores pdev->dev.of_node in a local np variable. This is
> a borrowed pointer and the probe function does not take a reference to
> it.
> 
> The success and error paths nevertheless call of_node_put(np). This drops
> a reference that is owned by the platform device, and can leave
> pdev->dev.of_node with an unbalanced reference count.
> 
> Do not put the borrowed platform device node from omap2430_probe().
> References taken for the child MUSB device are handled by the device core,
> and the ctrl-module phandle reference is still released separately.
> 
> Fixes: e194ce048f5a ("usb: musb: omap2430: Fix use-after-free in omap2430_probe()")

This was not the commit that introduced the issue. This should be:

Fixes: ffbe2feac59b ("usb: musb: omap2430: Fix probe regression for missing resources")

and this should be backported to stable as well:

Cc: stable@vger.kernel.org

> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

And again, how are you finding these issues? Still no LLM involved?

With the above fixed:

Reviewed-by: Johan Hovold <johan@kernel.org>

Johan

Re: [PATCH] usb: musb: omap2430: Do not put borrowed of_node in probe

[Guangshuo Li]

Hi Johan,

Thanks for the correction and review.

On Mon, 6 Jul 2026 at 15:07, Johan Hovold <johan@kernel.org> wrote:
>
> On Sun, Jul 05, 2026 at 05:14:11PM +0800, Guangshuo Li wrote:
> > omap2430_probe() stores pdev->dev.of_node in a local np variable. This is
> > a borrowed pointer and the probe function does not take a reference to
> > it.
> >
> > The success and error paths nevertheless call of_node_put(np). This drops
> > a reference that is owned by the platform device, and can leave
> > pdev->dev.of_node with an unbalanced reference count.
> >
> > Do not put the borrowed platform device node from omap2430_probe().
> > References taken for the child MUSB device are handled by the device core,
> > and the ctrl-module phandle reference is still released separately.
> >
> > Fixes: e194ce048f5a ("usb: musb: omap2430: Fix use-after-free in omap2430_probe()")
>
> This was not the commit that introduced the issue. This should be:
>
> Fixes: ffbe2feac59b ("usb: musb: omap2430: Fix probe regression for missing resources")
>
> and this should be backported to stable as well:
>
> Cc: stable@vger.kernel.org
>
> > Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
>
> And again, how are you finding these issues? Still no LLM involved?
>
> With the above fixed:
>
> Reviewed-by: Johan Hovold <johan@kernel.org>
>
> Johan

I will fix the Fixes tag and add the stable Cc in v2.  And I found
this issue through manual code auditing.

Thanks,
Guangshuo