From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
To: WenTao Liang <vulab@iscas.ac.cn>
Cc: Thinh Nguyen <Thinh.Nguyen@synopsys.com>,
"gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>,
"neil.armstrong@linaro.org" <neil.armstrong@linaro.org>,
"khilman@baylibre.com" <khilman@baylibre.com>,
"jbrunet@baylibre.com" <jbrunet@baylibre.com>,
"martin.blumenstingl@googlemail.com"
<martin.blumenstingl@googlemail.com>,
"linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>,
"linux-arm-kernel@lists.infradead.org"
<linux-arm-kernel@lists.infradead.org>,
"linux-amlogic@lists.infradead.org"
<linux-amlogic@lists.infradead.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"stable@vger.kernel.org" <stable@vger.kernel.org>
Subject: Re: [PATCH] usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
Date: Fri, 26 Jun 2026 23:20:51 +0000 [thread overview]
Message-ID: <aj8Gyn2ClDFDqRx0@vbox> (raw)
In-Reply-To: <20260611131121.81784-1-vulab@iscas.ac.cn>
On Thu, Jun 11, 2026, WenTao Liang wrote:
> If dwc3_meson_g12a_resume() succeeds in calling
> reset_control_reset(), an internal triggered_count reference is
> acquired. If any later step fails (usb_init, phy_init,
> phy_power_on, regulator_enable, or usb_post_init), the function
> returns the error without rearming the reset control. This leaks
> the reference and leaves the reset control in a triggered state,
> causing future reset_control_reset() calls to incorrectly return
> early as if already reset.
>
> Add an error path that calls reset_control_rearm() to balance
> the reference before returning the error.
>
> Cc: stable@vger.kernel.org
> Fixes: 5b0ba0caaf3a ("usb: dwc3: meson-g12a: refactor usb init")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
> ---
> drivers/usb/dwc3/dwc3-meson-g12a.c | 14 +++++++++-----
> 1 file changed, 9 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/usb/dwc3/dwc3-meson-g12a.c b/drivers/usb/dwc3/dwc3-meson-g12a.c
> index 55e144ba8cfc..4d611c08e8a4 100644
> --- a/drivers/usb/dwc3/dwc3-meson-g12a.c
> +++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
> @@ -907,35 +907,39 @@ static int __maybe_unused dwc3_meson_g12a_resume(struct device *dev)
>
> ret = priv->drvdata->usb_init(priv);
> if (ret)
> - return ret;
> + goto err_rearm;
>
> /* Init PHYs */
> for (i = 0 ; i < PHY_COUNT ; ++i) {
> ret = phy_init(priv->phys[i]);
> if (ret)
> - return ret;
> + goto err_rearm;
Should we unwind here and below instead of just reset_control_rearm? I
see we do that in probe() error path.
BR,
Thinh
> }
>
> /* Set PHY Power */
> for (i = 0 ; i < PHY_COUNT ; ++i) {
> ret = phy_power_on(priv->phys[i]);
> if (ret)
> - return ret;
> + goto err_rearm;
> }
>
> if (priv->vbus && priv->otg_phy_mode == PHY_MODE_USB_HOST) {
> ret = regulator_enable(priv->vbus);
> if (ret)
> - return ret;
> + goto err_rearm;
> }
>
> if (priv->drvdata->usb_post_init) {
> ret = priv->drvdata->usb_post_init(priv);
> if (ret)
> - return ret;
> + goto err_rearm;
> }
>
> return 0;
> +
> +err_rearm:
> + reset_control_rearm(priv->reset);
> + return ret;
> }
>
> static const struct dev_pm_ops dwc3_meson_g12a_dev_pm_ops = {
> --
> 2.50.1 (Apple Git-155)
>
prev parent reply other threads:[~2026-06-27 1:49 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-11 13:11 [PATCH] usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() WenTao Liang
2026-06-26 23:20 ` Thinh Nguyen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aj8Gyn2ClDFDqRx0@vbox \
--to=thinh.nguyen@synopsys.com \
--cc=gregkh@linuxfoundation.org \
--cc=jbrunet@baylibre.com \
--cc=khilman@baylibre.com \
--cc=linux-amlogic@lists.infradead.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=martin.blumenstingl@googlemail.com \
--cc=neil.armstrong@linaro.org \
--cc=stable@vger.kernel.org \
--cc=vulab@iscas.ac.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox