Re: [PATCH v2] usb: misc: uss720: properly clean up reference in uss720_probe()

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Mon, Feb 23, 2026 at 12:28:29PM +0100, Oliver Neukum wrote:
> Hi,
> 
> On 23.02.26 12:17, Greg Kroah-Hartman wrote:
> > If get_1284_register() fails, the usb device reference count is
> > incorrect and needs to be properly dropped before returning.
> > 
> > Cc: stable <stable@kernel.org>
> > Assisted-by: gkh_clanker_2000
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > ---
> >   v2: properly clean up the previously allocated resources by jumping to
> >       the error path and not just retrning directly
> > 
> >   drivers/usb/misc/uss720.c | 6 ++++--
> >   1 file changed, 4 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
> > index ec8bd968c4de..54107bf280df 100644
> > --- a/drivers/usb/misc/uss720.c
> > +++ b/drivers/usb/misc/uss720.c
> > @@ -735,8 +735,10 @@ static int uss720_probe(struct usb_interface *intf,
> >   	 * here. */
> >   	ret = get_1284_register(pp, 0, &reg, GFP_KERNEL);
> >   	dev_dbg(&intf->dev, "reg: %7ph\n", priv->reg);
> > -	if (ret < 0)
> > -		return ret;
> > +	if (ret < 0) {
> > +		usb_put_dev(usbdev);
> > +		goto probe_abort;
> 
> This jumps to probe_abort, which calls destroy_priv() indirectly
> via kref_put(). Either that works, which would mean that you must
> _not_ do a second usb_put_dev() or it does not, in which case the
> earlier error handling for parport_register_port() is incorrect.
> 
> Either way, there is a problem.

Argh, I missed that part of the error path, you are right.  The existing
code is wrong for the earlier cleanup logic, I'll go fix that instead,
thanks for the review.

It's tricky stuff like this which makes me can't wait for rust to be
possible for USB drivers, someday...

thanks,

greg k-h