[PATCH] usb: phy: fsl-usb: clear fsl_otg_dev after freeing it

[Guangshuo Li]

fsl_otg_dev is a file-scoped singleton pointer and is used by
fsl_otg_conf() to decide whether the OTG device has already been
initialized.

fsl_otg_remove() frees fsl_otg_dev but leaves the global pointer
unchanged. A later bind can therefore see a non-NULL dangling pointer,
skip initialization, and continue using freed memory through the global
fsl_otg_dev pointer.

Clear fsl_otg_dev after freeing it so that a later probe does not treat a
dangling pointer as an initialized device.

Fixes: 0807c500a1a6 ("USB: add Freescale USB OTG Transceiver driver")
Signed-off-by: Guangshuo Li <lgs201920130...@gmail.com>
---
 drivers/usb/phy/phy-fsl-usb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/phy/phy-fsl-usb.c b/drivers/usb/phy/phy-fsl-usb.c
index 35d79f11b03d..0b5e937633f4 100644
--- a/drivers/usb/phy/phy-fsl-usb.c
+++ b/drivers/usb/phy/phy-fsl-usb.c
@@ -997,6 +997,7 @@ static void fsl_otg_remove(struct platform_device *pdev)
        fsl_otg_uninit_timers();
        kfree(fsl_otg_dev->phy.otg);
        kfree(fsl_otg_dev);
+       fsl_otg_dev = NULL;
 
        if (pdata->exit)
                pdata->exit(pdev);
-- 
2.43.0