Re: [PATCH] usb: musb: ux500: Fix transceiver leak in ux500_musb_init()

[Linus Walleij]

On Wed, Sep 16, 2026 at 6:51 PM Wentao Liang <vulab@xxxxxxxxxxx> wrote:

> ux500_musb_init() takes a reference on the USB2 transceiver with
> usb_get_phy() and stores it in musb->xceiv. If the subsequent
> usb_register_notifier() call fails, the function returns without
> releasing the reference, leaking the transceiver. The only place the
> reference is put is ux500_musb_exit(), which is not run when the init
> fails.
>
> Put the transceiver before returning on the notifier registration
> failure path. The notifier itself does not need to be unregistered
> since usb_register_notifier() failed.
>
> Fixes: 0135522c4898 ("usb: musb: ux500: add otg notifier support")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>

Reviewed-by: Linus Walleij <linusw@xxxxxxxxxx>

Yours,
Linus Walleij