Commit 0b9fcab1 authored by Felix Gu's avatar Felix Gu Committed by Greg Kroah-Hartman
Browse files

usb: ulpi: fix memory leak on ulpi_register() error paths 



Commit 01af5423 ("usb: ulpi: fix double free in
ulpi_register_interface() error path") removed kfree(ulpi) from
ulpi_register_interface() to fix a double-free when device_register()
fails.

But when ulpi_of_register() or ulpi_read_id() fail before
device_register() is called, the ulpi allocation is leaked.

Add kfree(ulpi) on both error paths to properly clean up the allocation.

Fixes: 01af5423 ("usb: ulpi: fix double free in ulpi_register_interface() error path")
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarFelix Gu <ustc.gu@gmail.com>
Reviewed-by: default avatarHeikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260407-ulpi-v1-1-f3fafe53f7b2@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 3f91484f

drivers/usb/common/ulpi.c

+4 −1
Original line number Diff line number Diff line
@@ -286,12 +286,15 @@ static int ulpi_register(struct device *dev, struct ulpi *ulpi) 
	ACPI_COMPANION_SET(&ulpi->dev, ACPI_COMPANION(dev));



	ret = ulpi_of_register(ulpi);

	if (ret)

	if (ret) {

		kfree(ulpi);

		return ret;

	}



	ret = ulpi_read_id(ulpi);

	if (ret) {

		of_node_put(ulpi->dev.of_node);

		kfree(ulpi);

		return ret;

	}