usb: musb: omap2430: Fix use-after-free in omap2430_probe()

In omap2430_probe(), of_node_put(np) is called prematurely before the
last access to np, leading to a use-after-free if the node's reference
count drops to zero. Move the of_node_put() calls after the last use of
np in both the success and error paths.

Fixes: ffbe2feac59b ("usb: musb: omap2430: Fix probe regression for missing resources")
Cc: stable <stable@kernel.org>
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260409101104.480623-1-vulab@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 48bb9bfb22043977af0a01e7b9cf3d6329d6de1c..333ab79f0ca90f3ce91c8c23dddf946efd204af2 100644 (file)
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -337,7 +337,6 @@ static int omap2430_probe(struct platform_device *pdev)
        } else {
                device_set_of_node_from_dev(&musb->dev, &pdev->dev);
        }
-       of_node_put(np);
 
        glue->dev                       = &pdev->dev;
        glue->musb                      = musb;
@@ -455,6 +454,7 @@ static int omap2430_probe(struct platform_device *pdev)
                dev_err(&pdev->dev, "failed to register musb device\n");
                goto err_disable_rpm;
        }
+       of_node_put(np);
 
        return 0;
 
@@ -464,6 +464,7 @@ err_put_control_otghs:
        if (!IS_ERR(glue->control_otghs))
                put_device(glue->control_otghs);
 err_put_musb:
+       of_node_put(np);
        platform_device_put(musb);
 
        return ret;