usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error...

[ Upstream commit 74adad500346fb07d69af2c79acbff4adb061134 ]

Current implementation of ci_hdrc_imx_driver does not decrement the
refcount of the device obtained in usbmisc_get_init_data(). Add a
put_device() call in .remove() and in .probe() before returning an
error.

This bug was found by an experimental static analysis tool that I am
developing.

Cc: stable <stable@kernel.org>
Fixes: f40017e0f332 ("chipidea: usbmisc_imx: Add USB support for VF610 SoCs")
Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://lore.kernel.org/r/20241216015539.352579-1-joe@pf.is.s.u-tokyo.ac.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index 9f4253777d0de9403a19403be8480a121b2929c7..13731e85980e279ae0c8f974c969bdb95ad4045b 100644 (file)
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -355,25 +355,29 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
                data->pinctrl = devm_pinctrl_get(dev);
                if (PTR_ERR(data->pinctrl) == -ENODEV)
                        data->pinctrl = NULL;
-               else if (IS_ERR(data->pinctrl))
-                       return dev_err_probe(dev, PTR_ERR(data->pinctrl),
+               else if (IS_ERR(data->pinctrl)) {
+                       ret = dev_err_probe(dev, PTR_ERR(data->pinctrl),
                                             "pinctrl get failed\n");
+                       goto err_put;
+               }
 
                data->hsic_pad_regulator =
                                devm_regulator_get_optional(dev, "hsic");
                if (PTR_ERR(data->hsic_pad_regulator) == -ENODEV) {
                        /* no pad regualator is needed */
                        data->hsic_pad_regulator = NULL;
-               } else if (IS_ERR(data->hsic_pad_regulator))
-                       return dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
+               } else if (IS_ERR(data->hsic_pad_regulator)) {
+                       ret = dev_err_probe(dev, PTR_ERR(data->hsic_pad_regulator),
                                             "Get HSIC pad regulator error\n");
+                       goto err_put;
+               }
 
                if (data->hsic_pad_regulator) {
                        ret = regulator_enable(data->hsic_pad_regulator);
                        if (ret) {
                                dev_err(dev,
                                        "Failed to enable HSIC pad regulator\n");
-                               return ret;
+                               goto err_put;
                        }
                }
        }
@@ -387,13 +391,14 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
                        dev_err(dev,
                                "pinctrl_hsic_idle lookup failed, err=%ld\n",
                                        PTR_ERR(pinctrl_hsic_idle));
-                       return PTR_ERR(pinctrl_hsic_idle);
+                       ret = PTR_ERR(pinctrl_hsic_idle);
+                       goto err_put;
                }
 
                ret = pinctrl_select_state(data->pinctrl, pinctrl_hsic_idle);
                if (ret) {
                        dev_err(dev, "hsic_idle select failed, err=%d\n", ret);
-                       return ret;
+                       goto err_put;
                }
 
                data->pinctrl_hsic_active = pinctrl_lookup_state(data->pinctrl,
@@ -402,7 +407,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
                        dev_err(dev,
                                "pinctrl_hsic_active lookup failed, err=%ld\n",
                                        PTR_ERR(data->pinctrl_hsic_active));
-                       return PTR_ERR(data->pinctrl_hsic_active);
+                       ret = PTR_ERR(data->pinctrl_hsic_active);
+                       goto err_put;
                }
        }
 
@@ -502,6 +508,8 @@ disable_hsic_regulator:
        if (pdata.flags & CI_HDRC_PMQOS)
                cpu_latency_qos_remove_request(&data->pm_qos_req);
        data->ci_pdev = NULL;
+err_put:
+       put_device(data->usbmisc_data->dev);
        return ret;
 }
 
@@ -525,6 +533,7 @@ static void ci_hdrc_imx_remove(struct platform_device *pdev)
                if (data->hsic_pad_regulator)
                        regulator_disable(data->hsic_pad_regulator);
        }
+       put_device(data->usbmisc_data->dev);
 }
 
 static void ci_hdrc_imx_shutdown(struct platform_device *pdev)