[PATCH] usb: chipidea: tegra: fix refcount leak in tegra_usb_reset_controller()

[WenTao Liang]

In tegra_usb_reset_controller(), reset_control_deassert() is called on
a shared reset control to increment its deassert_count before toggling
the reset line.  If the subsequent reset_control_assert() call fails
(e.g. due to a missing reset controller device or an invalid internal
state), the function returns an error without ever balancing the prior
deassert.  Since the reset control is shared, the leaked deassert_count
remains elevated, preventing future reset_control_assert() calls from
taking effect on the reset line and leaving the USB controller in an
inconsistent state.

Fix the leak by calling reset_control_deassert() in the error path of
reset_control_assert(), ensuring the usage counter is properly balanced
before returning the error.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
 drivers/usb/chipidea/ci_hdrc_tegra.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/chipidea/ci_hdrc_tegra.c b/drivers/usb/chipidea/ci_hdrc_tegra.c
index 372788f0f970..8d313345665c 100644
--- a/drivers/usb/chipidea/ci_hdrc_tegra.c
+++ b/drivers/usb/chipidea/ci_hdrc_tegra.c
@@ -138,8 +138,10 @@ static int tegra_usb_reset_controller(struct device *dev)
 		return err;
 
 	err = reset_control_assert(rst);
-	if (err)
+	if (err) {
+		reset_control_deassert(rst);
 		return err;
+	}
 
 	udelay(1);
 
-- 
2.50.1 (Apple Git-155)