In host mode, ux500_musb_probe() allocates the struct musb with
musb_init_controller() and returns the error when musb_lowlevel_init()
fails, for example when no device is connected. The struct musb is not
freed on this path, and the driver core then frees the private data that
holds the only pointer to it. Each 'usb reset', or 'usb start' after
'usb stop', probes the controller again and leaks another one.
Free the struct musb when musb_lowlevel_init() fails.
Fixes: 845d9cf61c3a ("usb: musb-new: Add glue driver for ST-Ericsson Ux500")
Signed-off-by: Yuho Choi <[email protected]>
---
Build-tested only, with stemmy_defconfig and CONFIG_USB_MUSB_HOST=y.
When musb_start() fails, as it does when ux500_musb_enable() cannot
power on the PHY, musb_lowlevel_init() returns without calling
musb_stop(), so the platform init done by musb_init_controller() is not
undone either. That is not changed here.
drivers/usb/musb-new/ux500.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/musb-new/ux500.c b/drivers/usb/musb-new/ux500.c
index be0085f403d..c38faa24582 100644
--- a/drivers/usb/musb-new/ux500.c
+++ b/drivers/usb/musb-new/ux500.c
@@ -123,7 +123,11 @@ static int ux500_musb_probe(struct udevice *dev)
if (!host->host)
return -EIO;
- return musb_lowlevel_init(host);
+ ret = musb_lowlevel_init(host);
+ if (ret)
+ free(host->host);
+
+ return ret;
#else
pdata.mode = MUSB_PERIPHERAL;
host->host = musb_init_controller(&pdata, &glue->dev, base);
--
2.43.0
