Re: [PATCH v2] usb: musb: ux500: Fix transceiver leak in ux500_musb_init()

[sashiko-bot@kernel.org]

> ux500_musb_init() takes a reference on the USB2 transceiver with
> usb_get_phy() and stores it in musb->xceiv. If the following
> usb_register_notifier() fails, the function returns without releasing
> that reference.
> 
> The reference is only dropped in ux500_musb_exit(), and that callback is
> not reached on this path: musb_init_controller() jumps straight to its
> fail1 label when musb_platform_init() returns an error, while
> musb_platform_exit() is only called from the fail2 path. The reference is
> therefore leaked.
> 
> Put the transceiver on the notifier registration failure path. The
> notifier itself does not need to be unregistered, since
> usb_register_notifier() failed and never added it to the chain.
> 
> The bug was found with a static analysis tool; the candidate was then
> audited and the fix written with the help of DeepSeek-V4.1-Flash and
> GPT-6.1-Sol, and the result was checked by hand before submission.
> 
> Fixes: 0135522c4898 ("usb: musb: ux500: add otg notifier support")
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/all/20260916165055.2085246-1-vulab@iscas.ac.cn/
> Reviewed-by: Linus Walleij <linusw@kernel.org>
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107164653.481516-1-vulab@iscas.ac.cn?part=1