[PATCH] usb: cdns3: Fix PCI function reference leak in cdns3_pci_probe()
From: Wentao Liang
Date: Thu Sep 17 2026 - 13:04:55 EST
cdns3_get_second_fun() returns a device obtained with pci_get_device(),
which takes a reference to it. cdns3_pci_probe() never drops that
reference, so it leaks it on every exit path, including the successful
one.
Release it on all paths through a common put_func label.
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
drivers/usb/cdns3/cdns3-pci-wrap.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/cdns3/cdns3-pci-wrap.c b/drivers/usb/cdns3/cdns3-pci-wrap.c
index eb5760f75b9d..1ad722e7704d 100644
--- a/drivers/usb/cdns3/cdns3-pci-wrap.c
+++ b/drivers/usb/cdns3/cdns3-pci-wrap.c
@@ -89,7 +89,7 @@ static int cdns3_pci_probe(struct pci_dev *pdev,
err = pcim_enable_device(pdev);
if (err) {
dev_err(&pdev->dev, "Enabling PCI device has failed %d\n", err);
- return err;
+ goto put_func;
}
pci_set_master(pdev);
@@ -98,8 +98,10 @@ static int cdns3_pci_probe(struct pci_dev *pdev,
wrap = pci_get_drvdata(func);
} else {
wrap = kzalloc_obj(*wrap);
- if (!wrap)
- return -ENOMEM;
+ if (!wrap) {
+ err = -ENOMEM;
+ goto put_func;
+ }
}
res = wrap->dev_res;
@@ -160,11 +162,16 @@ static int cdns3_pci_probe(struct pci_dev *pdev,
if (IS_ERR(wrap->plat_dev)) {
err = PTR_ERR(wrap->plat_dev);
kfree(wrap);
- return err;
+ goto put_func;
}
}
pci_set_drvdata(pdev, wrap);
+ err = 0;
+
+put_func:
+ pci_dev_put(func);
+
return err;
}
--
2.34.1