Re: [PATCH] usb: chipidea: otg: avoid workqueue resource leak if otg fsm init fail

Re: [PATCH] usb: chipidea: otg: avoid workqueue resource leak if otg fsm init fail

[sashiko-bot]

> From: Xu Yang <xu.yang_2@nxp.com>
> 
> If ci_hdrc_otg_fsm_init() fail, error propagates to ci_hdrc_probe(), which
> jumps to the deinit_gadget label, bypassing the deinit_otg label where the
> ci_otg_wq workqueue would normally be destroyed. Finally it cause resource
> leak on previous created workqueue.
> 
> Fixes: 57677be5ef83 ("usb: chipidea: usb OTG fsm initialization.")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xu Yang <xu.yang_2@nxp.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261030072130.276679-1-xu.yang_2@oss.nxp.com?part=1

[PATCH] usb: chipidea: otg: avoid workqueue resource leak if otg fsm init fail

[Xu Yang]

From: Xu Yang <xu.yang_2@nxp.com>

If ci_hdrc_otg_fsm_init() fail, error propagates to ci_hdrc_probe(), which
jumps to the deinit_gadget label, bypassing the deinit_otg label where the
ci_otg_wq workqueue would normally be destroyed. Finally it cause resource
leak on previous created workqueue.

Fixes: 57677be5ef83 ("usb: chipidea: usb OTG fsm initialization.")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
---
 drivers/usb/chipidea/otg.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c
index 5eb3b32c2e87..89a6a37815f0 100644
--- a/drivers/usb/chipidea/otg.c
+++ b/drivers/usb/chipidea/otg.c
@@ -246,6 +246,8 @@ static void ci_otg_work(struct work_struct *work)
  */
 int ci_hdrc_otg_init(struct ci_hdrc *ci)
 {
+	int ret;
+
 	INIT_WORK(&ci->work, ci_otg_work);
 	ci->wq = create_freezable_workqueue("ci_otg");
 	if (!ci->wq) {
@@ -253,8 +255,13 @@ int ci_hdrc_otg_init(struct ci_hdrc *ci)
 		return -ENODEV;
 	}
 
-	if (ci_otg_is_fsm_mode(ci))
-		return ci_hdrc_otg_fsm_init(ci);
+	if (ci_otg_is_fsm_mode(ci)) {
+		ret = ci_hdrc_otg_fsm_init(ci);
+		if (ret < 0) {
+			destroy_workqueue(ci->wq);
+			return ret;
+		}
+	}
 
 	return 0;
 }
-- 
2.34.1