In host mode, musb_usb_probe() allocates the struct musb with
musb_init_controller() and returns the error when musb_lowlevel_init()
fails, for example when no device is connected. The struct musb is not
freed on this path, and the driver core then frees the private data that
holds the only pointer to it. Each 'usb reset', or 'usb start' after
'usb stop', probes the controller again and leaks another one.
Commit 7c22e26ec5ba ("sunxi: musb: Re-init musb controller on repeated
probe calls") made the probe call musb_usb_remove() on this error, but
the call was dropped when the driver was converted to driver model.
Free the struct musb when musb_lowlevel_init() fails.
Fixes: 3a61b080acee ("musb: sunxi: switch to the device model")
Signed-off-by: Yuho Choi <[email protected]>
---
Build-tested only, with A33-OLinuXino_defconfig.
When musb_start() fails, as it does when no host cable is detected,
musb_lowlevel_init() returns without calling musb_stop(), so the
platform init done by musb_init_controller() is not undone either. That
is not changed here.
drivers/usb/musb-new/sunxi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/musb-new/sunxi.c b/drivers/usb/musb-new/sunxi.c
index 0747f025f2a..1f1c33a6672 100644
--- a/drivers/usb/musb-new/sunxi.c
+++ b/drivers/usb/musb-new/sunxi.c
@@ -481,6 +481,8 @@ static int musb_usb_probe(struct udevice *dev)
ret = musb_lowlevel_init(host);
if (!ret)
printf("Allwinner mUSB OTG (Host)\n");
+ else
+ free(host->host);
#else
pdata.mode = MUSB_PERIPHERAL;
host->host = musb_register(&pdata, &glue->dev, base);
base-commit: feb8913982e4462c01fd914271f92254a25dc101
--
2.43.0
