Skip to content

Commit e07dea3

Browse files
ISCAS-Vulabvinodkoul
authored andcommitted
phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()
The for_each_available_child_of_node() calls of_node_put() to release child_np in each success loop. After breaking from the loop with the child_np has been released, the code will jump to the put_child label and will call the of_node_put() again if the devm_request_threaded_irq() fails. These cause a double free bug. Fix by returning directly to avoid the duplicate of_node_put(). Fixes: ed2b5a8 ("phy: phy-rockchip-inno-usb2: support muxed interrupts") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260109154626.2452034-1-vulab@iscas.ac.cn Signed-off-by: Vinod Koul <vkoul@kernel.org>
1 parent fb21116 commit e07dea3

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

drivers/phy/rockchip/phy-rockchip-inno-usb2.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1495,7 +1495,7 @@ static int rockchip_usb2phy_probe(struct platform_device *pdev)
14951495
rphy);
14961496
if (ret) {
14971497
dev_err_probe(rphy->dev, ret, "failed to request usb2phy irq handle\n");
1498-
goto put_child;
1498+
return ret;
14991499
}
15001500
}
15011501

0 commit comments

Comments
 (0)