Re: [PATCH] usb: chipidea: ci_hdrc_imx: decrement device's refcount on the error path of .probe()

[Joe Hattori <joe@xxxxxxxxxxxxxxxxxxxxx>]

Hi Peter,

Thank you for your review.

On 12/16/24 10:29, Peter Chen wrote:
> On 24-12-12 18:49:45, Joe Hattori wrote:
> > Current implementation of ci_hdrc_imx_probe() does not decrement the
> > refcount of the device obtained in usbmisc_get_init_data(). Add a
> > put_device() call before returning an error after the call.
> >
> > This bug was found by an experimental static analysis tool that I am
> > developing.
> >
> > Cc: stable@xxxxxxxxxxxxxxx
> > Fixes: f40017e0f332 ("chipidea: usbmisc_imx: Add USB support for VF610 SoCs")
> > Signed-off-by: Joe Hattori <joe@xxxxxxxxxxxxxxxxxxxxx>
> > ---
> >   drivers/usb/chipidea/ci_hdrc_imx.c | 24 ++++++++++++++++--------
> >   1 file changed, 16 insertions(+), 8 deletions(-)
> >
> > diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
> > index f2801700be8e..6418052264f2 100644
> > --- a/drivers/usb/chipidea/ci_hdrc_imx.c
> > +++ b/drivers/usb/chipidea/ci_hdrc_imx.c
> > @@ -370,25 +370,29 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
> >   		data->pinctrl = devm_pinctrl_get(dev);
> >   		if (PTR_ERR(data->pinctrl) == -ENODEV)
> >   			data->pinctrl = NULL;
> > -		else if (IS_ERR(data->pinctrl))
> > -			return dev_err_probe(dev, PTR_ERR(data->pinctrl),
> > +		else if (IS_ERR(data->pinctrl)) {
> > +			ret = dev_err_probe(dev, PTR_ERR(data->pinctrl),
> >   					     "pinctrl get failed\n");
> > +			goto err_put;
> > +		}
> >   
> >   		data->hsic_pad_regulator =
> >   				devm_regulator_get_optional(dev, "hsic");
> >   		if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) {
> >   			/* no pad regulator is needed */
> >   			data->hsic_pad_regulator = NULL;
> > -		} else if (IS_ERR(data->hsic_pad_regulator))
> > -			return dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
> > +		} else if (IS_ERR(data->hsic_pad_regulator)) {
> > +			ret = dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
> >   					     "Get HSIC pad regulator error\n");
> > +			goto err_put;
> > +		}
> >   
> >   		if (data->hsic_pad_regulator) {
> >   			ret = regulator_enable(data->hsic_pad_regulator);
> >   			if (ret) {
> >   				dev_err(dev,
> >   					"Failed to enable HSIC pad regulator\n");
> > -				return ret;
> > +				goto err_put;
> >   			}
> >   		}
> >   	}
> > @@ -402,13 +406,14 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
> >   			dev_err(dev,
> >   				"pinctrl_hsic_idle lookup failed, err=%ld\n",
> >   					PTR_ERR(pinctrl_hsic_idle));
> > -			return PTR_ERR(pinctrl_hsic_idle);
> > +			ret = PTR_ERR(pinctrl_hsic_idle);
> > +			goto err_put;
> >   		}
> >   
> >   		ret = pinctrl_select_state(data->pinctrl, pinctrl_hsic_idle);
> >   		if (ret) {
> >   			dev_err(dev, "hsic_idle select failed, err=%d\n", ret);
> > -			return ret;
> > +			goto err_put;
> >   		}
> >   
> >   		data->pinctrl_hsic_active = pinctrl_lookup_state(data->pinctrl,
> > @@ -417,7 +422,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
> >   			dev_err(dev,
> >   				"pinctrl_hsic_active lookup failed, err=%ld\n",
> >   					PTR_ERR(data->pinctrl_hsic_active));
> > -			return PTR_ERR(data->pinctrl_hsic_active);
> > +			ret = PTR_ERR(data->pinctrl_hsic_active);
> > +			goto err_put;
> >   		}
> >   	}
> >   
> > @@ -527,6 +533,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
> >   	if (pdata.flags & CI_HDRC_PMQOS)
> >   		cpu_latency_qos_remove_request(&data->pm_qos_req);
> >   	data->ci_pdev = NULL;
> > +err_put:
> > +	put_device(data->usbmisc_data->dev);
> >   	return ret;
> >   }
> >   
>
> Thanks for your fix, would you mind also add put_device at the end of
> ci_hdrc_imx_remove?

Thank you for pointing out. Fixed in the v2 patch.
> Peter

Best,
joe