[PATCH] usb: cdns3: Fix PCI function reference leak in cdns3_pci_remove()

From: Wentao Liang

Date: Thu Sep 17 2026 - 12:48:27 EST


cdns3_get_second_fun() returns a device obtained with pci_get_device(),
which takes a reference to it. cdns3_pci_remove() uses the device only
to check whether the second function is enabled and then returns without
dropping the reference.

Release it before returning.

Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
drivers/usb/cdns3/cdns3-pci-wrap.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/usb/cdns3/cdns3-pci-wrap.c b/drivers/usb/cdns3/cdns3-pci-wrap.c
index 1ad722e7704d..6639751ab22f 100644
--- a/drivers/usb/cdns3/cdns3-pci-wrap.c
+++ b/drivers/usb/cdns3/cdns3-pci-wrap.c
@@ -188,6 +188,8 @@ static void cdns3_pci_remove(struct pci_dev *pdev)

if (!pci_is_enabled(func))
kfree(wrap);
+
+ pci_dev_put(func);
}

static const struct pci_device_id cdns3_pci_ids[] = {
--
2.34.1