[PATCH] usb: gadget: Fix transceiver leak in pxa_udc_probe()

[Wentao Liang]

When the device is probed from platform data instead of device tree,
pxa_udc_probe() takes a reference on the USB2 transceiver with
usb_get_phy(USB_PHY_TYPE_USB2). This reference is only released in
pxa_udc_remove(), but the error paths taken after the transceiver has
been acquired return directly: a failed D+ gpio lookup, a failed
devm_clk_get() or clk_prepare() call, a failed devm_request_irq() and
a failed usb_add_gadget_udc() or udc_enable() call all leak the
reference.

Route those error paths to the existing err label so that the
transceiver is put together with the clk_unprepare() cleanup. The put
is guarded by !of_have_populated_dt(), because in the device tree case
the reference is taken by devm_usb_get_phy_by_phandle() and released
by devres when the probe fails.

Fixes: 7fec3c25b773 ("USB: pxa27x_udc: add otg transceiver support")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/usb/gadget/udc/pxa27x_udc.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/udc/pxa27x_udc.c b/drivers/usb/gadget/udc/pxa27x_udc.c
index 1abea0d48c35..5f4f66e571f9 100644
--- a/drivers/usb/gadget/udc/pxa27x_udc.c
+++ b/drivers/usb/gadget/udc/pxa27x_udc.c
@@ -2421,18 +2421,21 @@ static int pxa_udc_probe(struct platform_device *pdev)
 	if (IS_ERR(udc->gpiod)) {
 		dev_err(&pdev->dev, "Couldn't find or request D+ gpio : %ld\n",
 			PTR_ERR(udc->gpiod));
-		return PTR_ERR(udc->gpiod);
+		retval = PTR_ERR(udc->gpiod);
+		goto err;
 	}
 	if (udc->gpiod)
 		gpiod_direction_output(udc->gpiod, 0);
 
 	udc->clk = devm_clk_get(&pdev->dev, NULL);
-	if (IS_ERR(udc->clk))
-		return PTR_ERR(udc->clk);
+	if (IS_ERR(udc->clk)) {
+		retval = PTR_ERR(udc->clk);
+		goto err;
+	}
 
 	retval = clk_prepare(udc->clk);
 	if (retval)
-		return retval;
+		goto err;
 
 	udc->vbus_sensed = 0;
 
@@ -2471,6 +2474,8 @@ static int pxa_udc_probe(struct platform_device *pdev)
 		usb_unregister_notifier(udc->transceiver, &pxa27x_udc_phy);
 err:
 	clk_unprepare(udc->clk);
+	if (!of_have_populated_dt() && !IS_ERR_OR_NULL(udc->transceiver))
+		usb_put_phy(udc->transceiver);
 	return retval;
 }
 
-- 
2.34.1