[PATCH] usb: gadget: pxa27x_udc: let devres own the transceiver reference

[PATCH] usb: gadget: pxa27x_udc: let devres own the transceiver reference

[Wentao Liang]

pxa_udc_probe() looks up the USB2 transceiver with usb_get_phy() on
non-DT platforms.  That helper returns a reference which the caller has
to drop, and the driver only drops it in pxa_udc_remove().  Every probe
failure after the lookup (the clock lookup, clk_prepare() and all the
err labels) returns without a usb_put_phy(), so a failed probe leaks the
transceiver.

The DT path already uses devm_usb_get_phy_by_phandle(), so there devres
owns the reference.  pxa_udc_remove() nevertheless calls usb_put_phy()
for it as well, dropping the managed reference a second time.

Use devm_usb_get_phy() for the non-DT lookup, like the pxa25x UDC
driver does, so that both paths are managed, and drop the hand written
usb_put_phy() from pxa_udc_remove().

Fixes: 0c0e287d454a ("usb: gadget: pxa27x: add phy notifier event handler")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/usb/gadget/udc/pxa27x_udc.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/udc/pxa27x_udc.c b/drivers/usb/gadget/udc/pxa27x_udc.c
index df5cca43afbe..74fc75c9d7c1 100644
--- a/drivers/usb/gadget/udc/pxa27x_udc.c
+++ b/drivers/usb/gadget/udc/pxa27x_udc.c
@@ -2393,7 +2393,7 @@ static int pxa_udc_probe(struct platform_device *pdev)
 		if (IS_ERR(udc->transceiver))
 			return PTR_ERR(udc->transceiver);
 	} else {
-		udc->transceiver = usb_get_phy(USB_PHY_TYPE_USB2);
+		udc->transceiver = devm_usb_get_phy(udc->dev, USB_PHY_TYPE_USB2);
 	}
 
 	if (udc->gpiod)
@@ -2458,10 +2458,8 @@ static void pxa_udc_remove(struct platform_device *_dev)
 	usb_del_gadget_udc(&udc->gadget);
 	pxa_cleanup_debugfs(udc);
 
-	if (!IS_ERR_OR_NULL(udc->transceiver)) {
+	if (!IS_ERR_OR_NULL(udc->transceiver))
 		usb_unregister_notifier(udc->transceiver, &pxa27x_udc_phy);
-		usb_put_phy(udc->transceiver);
-	}
 
 	udc->transceiver = NULL;
 	the_controller = NULL;
-- 
2.34.1

Re: [PATCH] usb: gadget: pxa27x_udc: let devres own the transceiver reference

[sashiko-bot]

> pxa_udc_probe() looks up the USB2 transceiver with usb_get_phy() on
> non-DT platforms.  That helper returns a reference which the caller has
> to drop, and the driver only drops it in pxa_udc_remove().  Every probe
> failure after the lookup (the clock lookup, clk_prepare() and all the
> err labels) returns without a usb_put_phy(), so a failed probe leaks the
> transceiver.
> 
> The DT path already uses devm_usb_get_phy_by_phandle(), so there devres
> owns the reference.  pxa_udc_remove() nevertheless calls usb_put_phy()
> for it as well, dropping the managed reference a second time.
> 
> Use devm_usb_get_phy() for the non-DT lookup, like the pxa25x UDC
> driver does, so that both paths are managed, and drop the hand written
> usb_put_phy() from pxa_udc_remove().
> 
> Fixes: 0c0e287d454a ("usb: gadget: pxa27x: add phy notifier event handler")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104021519.1468644-1-vulab@iscas.ac.cn?part=1