[PATCH] usb: musb: ux500: Fix transceiver leak in ux500_musb_init()

[PATCH] usb: musb: ux500: Fix transceiver leak in ux500_musb_init()

[Wentao Liang]

ux500_musb_init() takes a reference on the USB2 transceiver with
usb_get_phy() and stores it in musb->xceiv. If the subsequent
usb_register_notifier() call fails, the function returns without
releasing the reference, leaking the transceiver. The only place the
reference is put is ux500_musb_exit(), which is not run when the init
fails.

Put the transceiver before returning on the notifier registration
failure path. The notifier itself does not need to be unregistered
since usb_register_notifier() failed.

Fixes: 0135522c4898 ("usb: musb: ux500: add otg notifier support")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/usb/musb/ux500.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/musb/ux500.c b/drivers/usb/musb/ux500.c
index 8c2a43d992f5..14c5e986937e 100644
--- a/drivers/usb/musb/ux500.c
+++ b/drivers/usb/musb/ux500.c
@@ -155,6 +155,7 @@ static int ux500_musb_init(struct musb *musb)
 	status = usb_register_notifier(musb->xceiv, &musb->nb);
 	if (status < 0) {
 		dev_dbg(musb->controller, "notification register failed\n");
+		usb_put_phy(musb->xceiv);
 		return status;
 	}
 
-- 
2.34.1

Re: [PATCH] usb: musb: ux500: Fix transceiver leak in ux500_musb_init()

[Linus Walleij]

On Wed, Sep 16, 2026 at 6:51 PM Wentao Liang <vulab@iscas.ac.cn> wrote:

> ux500_musb_init() takes a reference on the USB2 transceiver with
> usb_get_phy() and stores it in musb->xceiv. If the subsequent
> usb_register_notifier() call fails, the function returns without
> releasing the reference, leaking the transceiver. The only place the
> reference is put is ux500_musb_exit(), which is not run when the init
> fails.
>
> Put the transceiver before returning on the notifier registration
> failure path. The notifier itself does not need to be unregistered
> since usb_register_notifier() failed.
>
> Fixes: 0135522c4898 ("usb: musb: ux500: add otg notifier support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Reviewed-by: Linus Walleij <linusw@kernel.org>

Yours,
Linus Walleij

Re: [PATCH] usb: musb: ux500: Fix transceiver leak in ux500_musb_init()

[Greg KH]

On Wed, Sep 16, 2026 at 04:50:55PM +0000, Wentao Liang wrote:
> ux500_musb_init() takes a reference on the USB2 transceiver with
> usb_get_phy() and stores it in musb->xceiv. If the subsequent
> usb_register_notifier() call fails, the function returns without
> releasing the reference, leaking the transceiver. The only place the
> reference is put is ux500_musb_exit(), which is not run when the init
> fails.
> 
> Put the transceiver before returning on the notifier registration
> failure path. The notifier itself does not need to be unregistered
> since usb_register_notifier() failed.
> 
> Fixes: 0135522c4898 ("usb: musb: ux500: add otg notifier support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/usb/musb/ux500.c | 1 +
>  1 file changed, 1 insertion(+)

Again, you need to add an assisted-by tag.  Please go back and fix up
_ALL_ of these to have that.

thanks,

greg k-h

[PATCH v2] usb: musb: ux500: Fix transceiver leak in ux500_musb_init()

[Wentao Liang]

ux500_musb_init() takes a reference on the USB2 transceiver with
usb_get_phy() and stores it in musb->xceiv. If the following
usb_register_notifier() fails, the function returns without releasing
that reference.

The reference is only dropped in ux500_musb_exit(), and that callback is
not reached on this path: musb_init_controller() jumps straight to its
fail1 label when musb_platform_init() returns an error, while
musb_platform_exit() is only called from the fail2 path. The reference is
therefore leaked.

Put the transceiver on the notifier registration failure path. The
notifier itself does not need to be unregistered, since
usb_register_notifier() failed and never added it to the chain.

The bug was found with a static analysis tool; the candidate was then
audited and the fix written with the help of DeepSeek-V4.1-Flash and
GPT-6.1-Sol, and the result was checked by hand before submission.

Fixes: 0135522c4898 ("usb: musb: ux500: add otg notifier support")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260916165055.2085246-1-vulab@iscas.ac.cn/
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
Changes in v2:
 - Do not add the Assisted-by trailer: current checkpatch.pl reports it as a
   non-standard signature, and Documentation/process/generated-content.rst
   asks for the tooling to be described in the changelog, which the commit
   message now does. Say the word if you would rather have the trailer and
   I will add it back.
 - Explain why musb_platform_exit() is not reached on this path, so the added
   usb_put_phy() cannot double-put.
 - Code unchanged from v1, so Linus's Reviewed-by is kept.
 - Sorry it took me this long to come back, and sorry for the extra work of
   chasing it.

 drivers/usb/musb/ux500.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/musb/ux500.c b/drivers/usb/musb/ux500.c
index 8c2a43d992f5..14c5e986937e 100644
--- a/drivers/usb/musb/ux500.c
+++ b/drivers/usb/musb/ux500.c
@@ -155,6 +155,7 @@ static int ux500_musb_init(struct musb *musb)
 	status = usb_register_notifier(musb->xceiv, &musb->nb);
 	if (status < 0) {
 		dev_dbg(musb->controller, "notification register failed\n");
+		usb_put_phy(musb->xceiv);
 		return status;
 	}
 
-- 
2.34.1

Re: [PATCH v2] usb: musb: ux500: Fix transceiver leak in ux500_musb_init()

[sashiko-bot]

> ux500_musb_init() takes a reference on the USB2 transceiver with
> usb_get_phy() and stores it in musb->xceiv. If the following
> usb_register_notifier() fails, the function returns without releasing
> that reference.
> 
> The reference is only dropped in ux500_musb_exit(), and that callback is
> not reached on this path: musb_init_controller() jumps straight to its
> fail1 label when musb_platform_init() returns an error, while
> musb_platform_exit() is only called from the fail2 path. The reference is
> therefore leaked.
> 
> Put the transceiver on the notifier registration failure path. The
> notifier itself does not need to be unregistered, since
> usb_register_notifier() failed and never added it to the chain.
> 
> The bug was found with a static analysis tool; the candidate was then
> audited and the fix written with the help of DeepSeek-V4.1-Flash and
> GPT-6.1-Sol, and the result was checked by hand before submission.
> 
> Fixes: 0135522c4898 ("usb: musb: ux500: add otg notifier support")
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/all/20260916165055.2085246-1-vulab@iscas.ac.cn/
> Reviewed-by: Linus Walleij <linusw@kernel.org>
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107164653.481516-1-vulab@iscas.ac.cn?part=1