[PATCH] usb: dwc2: debugfs: fix memory leak of hsotg->regset

[Huang Wei <huangwei@kylinos.cn>]

hsotg->regset is allocated in dwc2_debugfs_init() using devm_kzalloc()
but is never explicitly freed. While devres would eventually reclaim
the memory, the regset is logically owned by the debugfs lifetime:
dwc2_debugfs_exit() only removes the debugfs directory and leaves
hsotg->regset dangling.

Switch to kzalloc() and free it explicitly in dwc2_debugfs_exit(),
mirroring the equivalent fix already applied to dwc3 in commit
e6bdf8195b4a ("usb: dwc3: fix memory leak of dwc->regset"). Also set
the pointer to NULL after freeing to avoid a stale dangling pointer.

Reported-by: kakapapa2 <kakapapa2@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219977
Signed-off-by: Huang Wei <huangwei@kylinos.cn>
---
 drivers/usb/dwc2/debugfs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/dwc2/debugfs.c b/drivers/usb/dwc2/debugfs.c
index 3116ac72747f..2ecbf6523aaa 100644
--- a/drivers/usb/dwc2/debugfs.c
+++ b/drivers/usb/dwc2/debugfs.c
@@ -9,6 +9,7 @@
 #include <linux/spinlock.h>
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include <linux/uaccess.h>
 
 #include "core.h"
@@ -787,8 +788,7 @@ int dwc2_debugfs_init(struct dwc2_hsotg *hsotg)
 	/* Add gadget debugfs nodes */
 	dwc2_hsotg_create_debug(hsotg);
 
-	hsotg->regset = devm_kzalloc(hsotg->dev, sizeof(*hsotg->regset),
-								GFP_KERNEL);
+	hsotg->regset = kzalloc_obj(*hsotg->regset, GFP_KERNEL);
 	if (!hsotg->regset) {
 		ret = -ENOMEM;
 		goto err;
@@ -810,4 +810,6 @@ void dwc2_debugfs_exit(struct dwc2_hsotg *hsotg)
 {
 	debugfs_remove_recursive(hsotg->debug_root);
 	hsotg->debug_root = NULL;
+	kfree(hsotg->regset);
+	hsotg->regset = NULL;
 }
-- 
2.25.1