On Fri, Nov 06, 2026 at 02:37:52PM -0500, Yuho Choi wrote:
> In host mode, musb_usb_probe() allocates the struct musb with
> musb_init_controller() and returns the error when musb_lowlevel_init()
> fails, for example when no device is connected. The struct musb is not
> freed on this path, and the driver core then frees the private data that
> holds the only pointer to it. Each 'usb reset', or 'usb start' after
> 'usb stop', probes the controller again and leaks another one.
>
> Free the struct musb when musb_lowlevel_init() fails.
>
> Fixes: 7d017d607eaa ("usb: musb-new: mt85xx: add musb-new gadget driver.")
> Signed-off-by: Yuho Choi <[email protected]>
> ---
> Build-tested only, with mt8518_ap1_emmc_defconfig and
> CONFIG_USB_MUSB_HOST=y.
>
> drivers/usb/musb-new/mt85xx.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/usb/musb-new/mt85xx.c b/drivers/usb/musb-new/mt85xx.c
> index 14b28bbae6b..2e13b2a30d8 100644
> --- a/drivers/usb/musb-new/mt85xx.c
> +++ b/drivers/usb/musb-new/mt85xx.c
> @@ -365,6 +365,8 @@ static int musb_usb_probe(struct udevice *dev)
> ret = musb_lowlevel_init(host);
> if (!ret)
> printf("MTK MUSB OTG (Host)\n");
> + else
> + free(host->host);
> #else
> pdata.mode = MUSB_PERIPHERAL;
> host->host = musb_register(&pdata, &glue->dev, base);As your test notes, nothing builds like this normally today. And in the failure case we have more to worry about than just a resource leak. We shouldn't bother doing this until someone is going to handle the error case correctly. -- Tom
signature.asc
Description: PGP signature
