Re: [PATCH] usb: chipidea: tegra: fix refcount leak in tegra_usb_reset_controller()

[Peter Chen <peter.chen@kernel.org>]

On 26-06-11 20:49:40, WenTao Liang wrote:
> In tegra_usb_reset_controller(), reset_control_deassert() is called on
> a shared reset control to increment its deassert_count before toggling
> the reset line.  If the subsequent reset_control_assert() call fails
> (e.g. due to a missing reset controller device or an invalid internal
> state), the function returns an error without ever balancing the prior
> deassert.  Since the reset control is shared, the leaked deassert_count
> remains elevated, preventing future reset_control_assert() calls from
> taking effect on the reset line and leaving the USB controller in an
> inconsistent state.
> 
> Fix the leak by calling reset_control_deassert() in the error path of
> reset_control_assert(), ensuring the usage counter is properly balanced
> before returning the error.
> 
> Cc: stable@vger.kernel.org
> Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/usb/chipidea/ci_hdrc_tegra.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/chipidea/ci_hdrc_tegra.c b/drivers/usb/chipidea/ci_hdrc_tegra.c
> index 372788f0f970..8d313345665c 100644
> --- a/drivers/usb/chipidea/ci_hdrc_tegra.c
> +++ b/drivers/usb/chipidea/ci_hdrc_tegra.c
> @@ -138,8 +138,10 @@ static int tegra_usb_reset_controller(struct device *dev)
>  		return err;
>  
>  	err = reset_control_assert(rst);
> -	if (err)
> +	if (err) {
> +		reset_control_deassert(rst);

Could not understand why doing that, there is already a reset_control_deassert
calling before that.

-- 

Thanks,
Peter Chen