[PATCH v2] usb: host: ehci-atmel: stop clocks before releasing HCD

[PATCH v2] usb: host: ehci-atmel: stop clocks before releasing HCD

[Hongyan Xu]

usb_put_hcd() can release the HCD and its private data. Calling
atmel_stop_ehci() afterwards retrieves that HCD from platform data
and accesses its private clock state.

Stop the controller clocks after usb_remove_hcd() has quiesced the
host, but before dropping the driver's HCD reference. This matches
the probe error unwind, which already stops the clocks before
usb_put_hcd().

Found by the author's in-house static analysis tool.

Fixes: 501c9c0802d9 ("USB: at91: Add USB EHCI driver for at91sam9g45 series")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260806060557.1747-1-getshell@seu.edu.cn/
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Signed-off-by: Zehao Gao <gaozehao@iie.ac.cn>
---

Discovery: found by the author's in-house static analysis tool.

 drivers/usb/host/ehci-atmel.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/usb/host/ehci-atmel.c b/drivers/usb/host/ehci-atmel.c
index 6574727..bcd56f8 100644
--- a/drivers/usb/host/ehci-atmel.c
+++ b/drivers/usb/host/ehci-atmel.c
@@ -177,9 +177,8 @@ static void ehci_atmel_drv_remove(struct platform_device *pdev)
 	struct usb_hcd *hcd = platform_get_drvdata(pdev);
 
 	usb_remove_hcd(hcd);
-	usb_put_hcd(hcd);
-
 	atmel_stop_ehci(pdev);
+	usb_put_hcd(hcd);
 }
 
 static int __maybe_unused ehci_atmel_drv_suspend(struct device *dev)
-- 
2.50.1.windows.1

Re: [PATCH v2] usb: host: ehci-atmel: stop clocks before releasing HCD

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] usb: ehci-atmel: Fixes tag cites 501c9c0802d9 instead of
  7baddacbe1bc
--

commit 01c8113ae4f3e9e4bce884feb37af84c2ce05255
Author: Hongyan Xu <getshell@seu.edu.cn>

> usb: host: ehci-atmel: stop clocks before releasing HCD
>
> usb_put_hcd() can release the HCD and its private data. Calling
> atmel_stop_ehci() afterwards retrieves that HCD from platform data
> and accesses its private clock state.
>
> Stop the controller clocks after usb_remove_hcd() has quiesced the
> host, but before dropping the driver's HCD reference. This matches
> the probe error unwind, which already stops the clocks before
> usb_put_hcd().
>
> Found by the author's in-house static analysis tool.
>
> Fixes: 501c9c0802d9 ("USB: at91: Add USB EHCI driver for at91sam9g45 series")
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/all/20260806060557.1747-1-getshell@seu.edu.cn/
> Acked-by: Alan Stern <stern@rowland.harvard.edu>
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
> Signed-off-by: Zehao Gao <gaozehao@iie.ac.cn>

[Severity: Low]
In 501c9c0802d9 ("USB: at91: Add USB EHCI driver for at91sam9g45 series"),
the clock state was stored in file-scope static variables and
atmel_stop_ehci() did not access hcd or its private data.  The clocks were
moved into struct atmel_ehci_priv inside hcd->hcd_priv and dereferenced in
atmel_stop_ehci() by 7baddacbe1bc ("USB: host: ehci-atmel: Move global
variables to private struct").

Should the Fixes tag be:

  Fixes: 7baddacbe1bc ("USB: host: ehci-atmel: Move global variables to private struct")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/179474328429.103840.11561415733183356947@seu.edu.cn?part=1