[PATCH] usb: phy: fsl-usb: clear fsl_otg_dev after freeing it

[PATCH] usb: phy: fsl-usb: clear fsl_otg_dev after freeing it

[Guangshuo Li]

fsl_otg_dev is a file-scoped singleton pointer and is used by
fsl_otg_conf() to decide whether the OTG device has already been
initialized.

fsl_otg_remove() frees fsl_otg_dev but leaves the global pointer
unchanged. A later bind can therefore see a non-NULL dangling pointer,
skip initialization, and continue using freed memory through the global
fsl_otg_dev pointer.

Clear fsl_otg_dev after freeing it so that a later probe does not treat a
dangling pointer as an initialized device.

Fixes: 0807c500a1a6 ("USB: add Freescale USB OTG Transceiver driver")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/usb/phy/phy-fsl-usb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/phy/phy-fsl-usb.c b/drivers/usb/phy/phy-fsl-usb.c
index 35d79f11b03d..0b5e937633f4 100644
--- a/drivers/usb/phy/phy-fsl-usb.c
+++ b/drivers/usb/phy/phy-fsl-usb.c
@@ -997,6 +997,7 @@ static void fsl_otg_remove(struct platform_device *pdev)
 	fsl_otg_uninit_timers();
 	kfree(fsl_otg_dev->phy.otg);
 	kfree(fsl_otg_dev);
+	fsl_otg_dev = NULL;
 
 	if (pdata->exit)
 		pdata->exit(pdev);
-- 
2.43.0

Re: [PATCH] usb: phy: fsl-usb: clear fsl_otg_dev after freeing it

[Greg Kroah-Hartman]

On Wed, Jul 08, 2026 at 02:45:49PM +0800, Guangshuo Li wrote:
> fsl_otg_dev is a file-scoped singleton pointer and is used by
> fsl_otg_conf() to decide whether the OTG device has already been
> initialized.
> 
> fsl_otg_remove() frees fsl_otg_dev but leaves the global pointer
> unchanged. A later bind can therefore see a non-NULL dangling pointer,
> skip initialization, and continue using freed memory through the global
> fsl_otg_dev pointer.
> 
> Clear fsl_otg_dev after freeing it so that a later probe does not treat a
> dangling pointer as an initialized device.
> 
> Fixes: 0807c500a1a6 ("USB: add Freescale USB OTG Transceiver driver")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/usb/phy/phy-fsl-usb.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/phy/phy-fsl-usb.c b/drivers/usb/phy/phy-fsl-usb.c
> index 35d79f11b03d..0b5e937633f4 100644
> --- a/drivers/usb/phy/phy-fsl-usb.c
> +++ b/drivers/usb/phy/phy-fsl-usb.c
> @@ -997,6 +997,7 @@ static void fsl_otg_remove(struct platform_device *pdev)
>  	fsl_otg_uninit_timers();
>  	kfree(fsl_otg_dev->phy.otg);
>  	kfree(fsl_otg_dev);
> +	fsl_otg_dev = NULL;
>  
>  	if (pdata->exit)
>  		pdata->exit(pdev);
> -- 
> 2.43.0
> 
> 

For all of these patches, you have to document that you use an LLM.
Please resend them all with that information.

thanks,
greg k-h