Re: [PATCH v2] usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error path of .probe()

[Peter Chen <peter.chen@kernel.org>]

On 24-12-16 10:55:39, Joe Hattori wrote:
> Current implementation of ci_hdrc_imx_driver does not decrement the
> refcount of the device obtained in usbmisc_get_init_data(). Add a
> put_device() call in .remove() and in .probe() before returning an
> error.
> 
> This bug was found by an experimental static analysis tool that I am
> developing.
> 
> Cc: stable@vger.kernel.org
> Fixes: f40017e0f332 ("chipidea: usbmisc_imx: Add USB support for VF610 SoCs")
> Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>

Acked-by: Peter Chen <peter.chen@kernel.org>

> ---
> Changes in v2:
> - Put the device in .remove() as well.
> ---
>  drivers/usb/chipidea/ci_hdrc_imx.c | 25 +++++++++++++++++--------
>  1 file changed, 17 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
> index f2801700be8e..1a7fc638213e 100644
> --- a/drivers/usb/chipidea/ci_hdrc_imx.c
> +++ b/drivers/usb/chipidea/ci_hdrc_imx.c
> @@ -370,25 +370,29 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
>  		data->pinctrl = devm_pinctrl_get(dev);
>  		if (PTR_ERR(data->pinctrl) == -ENODEV)
>  			data->pinctrl = NULL;
> -		else if (IS_ERR(data->pinctrl))
> -			return dev_err_probe(dev, PTR_ERR(data->pinctrl),
> +		else if (IS_ERR(data->pinctrl)) {
> +			ret = dev_err_probe(dev, PTR_ERR(data->pinctrl),
>  					     "pinctrl get failed\n");
> +			goto err_put;
> +		}
>  
>  		data->hsic_pad_regulator =
>  				devm_regulator_get_optional(dev, "hsic");
>  		if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) {
>  			/* no pad regulator is needed */
>  			data->hsic_pad_regulator = NULL;
> -		} else if (IS_ERR(data->hsic_pad_regulator))
> -			return dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
> +		} else if (IS_ERR(data->hsic_pad_regulator)) {
> +			ret = dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
>  					     "Get HSIC pad regulator error\n");
> +			goto err_put;
> +		}
>  
>  		if (data->hsic_pad_regulator) {
>  			ret = regulator_enable(data->hsic_pad_regulator);
>  			if (ret) {
>  				dev_err(dev,
>  					"Failed to enable HSIC pad regulator\n");
> -				return ret;
> +				goto err_put;
>  			}
>  		}
>  	}
> @@ -402,13 +406,14 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
>  			dev_err(dev,
>  				"pinctrl_hsic_idle lookup failed, err=%ld\n",
>  					PTR_ERR(pinctrl_hsic_idle));
> -			return PTR_ERR(pinctrl_hsic_idle);
> +			ret = PTR_ERR(pinctrl_hsic_idle);
> +			goto err_put;
>  		}
>  
>  		ret = pinctrl_select_state(data->pinctrl, pinctrl_hsic_idle);
>  		if (ret) {
>  			dev_err(dev, "hsic_idle select failed, err=%d\n", ret);
> -			return ret;
> +			goto err_put;
>  		}
>  
>  		data->pinctrl_hsic_active = pinctrl_lookup_state(data->pinctrl,
> @@ -417,7 +422,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
>  			dev_err(dev,
>  				"pinctrl_hsic_active lookup failed, err=%ld\n",
>  					PTR_ERR(data->pinctrl_hsic_active));
> -			return PTR_ERR(data->pinctrl_hsic_active);
> +			ret = PTR_ERR(data->pinctrl_hsic_active);
> +			goto err_put;
>  		}
>  	}
>  
> @@ -527,6 +533,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
>  	if (pdata.flags & CI_HDRC_PMQOS)
>  		cpu_latency_qos_remove_request(&data->pm_qos_req);
>  	data->ci_pdev = NULL;
> +err_put:
> +	put_device(data->usbmisc_data->dev);
>  	return ret;
>  }
>  
> @@ -551,6 +559,7 @@ static void ci_hdrc_imx_remove(struct platform_device *pdev)
>  		if (data->hsic_pad_regulator)
>  			regulator_disable(data->hsic_pad_regulator);
>  	}
> +	put_device(data->usbmisc_data->dev);
>  }
>  
>  static void ci_hdrc_imx_shutdown(struct platform_device *pdev)
> -- 
> 2.34.1
>