tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

phy: qcom-qusb2: Fix a memory leak on probe

On success nvmem_cell_read() returns a pointer to a dynamically allocated
buffer, and therefore it shall be freed after usage.

The issue is reported by kmemleak:

# cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff3b3803e4b280 (size 128):
comm "kworker/u16:1", pid 107, jiffies 4294892861 (age 94.120s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<000000007739afdc>] __kmalloc+0x27c/0x41c
[<0000000071c0fbf8>] nvmem_cell_read+0x40/0xe0
[<00000000e803ef1f>] qusb2_phy_init+0x258/0x5bc
[<00000000fc81fcfa>] phy_init+0x70/0x110
[<00000000e3d48a57>] dwc3_core_soft_reset+0x4c/0x234
[<0000000027d1dbd4>] dwc3_core_init+0x68/0x990
[<000000001965faf9>] dwc3_probe+0x4f4/0x730
[<000000002f7617ca>] platform_probe+0x74/0xf0
[<00000000a2576cac>] really_probe+0xc4/0x470
[<00000000bc77f2c5>] __driver_probe_device+0x11c/0x190
[<00000000130db71f>] driver_probe_device+0x48/0x110
[<0000000019f36c2b>] __device_attach_driver+0xa4/0x140
[<00000000e5812ff7>] bus_for_each_drv+0x84/0xe0
[<00000000f4bac574>] __device_attach+0xe4/0x1c0
[<00000000d3beb631>] device_initial_probe+0x20/0x30
[<000000008019b9db>] bus_probe_device+0xa4/0xb0

Fixes: ca04d9d3e1b1 ("phy: qcom-qusb2: New driver for QUSB2 PHY on Qcom chips")
Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20210922233548.2150244-1-vladimir.zapolskiy@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>

authored by

Vladimir Zapolskiy and committed by
Vinod Koul bf7ffcd0 8abe5e77

+10 -6
+10 -6
drivers/phy/qualcomm/phy-qcom-qusb2.c
··· 561 561 { 562 562 struct device *dev = &qphy->phy->dev; 563 563 const struct qusb2_phy_cfg *cfg = qphy->cfg; 564 - u8 *val; 564 + u8 *val, hstx_trim; 565 565 566 566 /* efuse register is optional */ 567 567 if (!qphy->cell) ··· 575 575 * set while configuring the phy. 576 576 */ 577 577 val = nvmem_cell_read(qphy->cell, NULL); 578 - if (IS_ERR(val) || !val[0]) { 578 + if (IS_ERR(val)) { 579 + dev_dbg(dev, "failed to read a valid hs-tx trim value\n"); 580 + return; 581 + } 582 + hstx_trim = val[0]; 583 + kfree(val); 584 + if (!hstx_trim) { 579 585 dev_dbg(dev, "failed to read a valid hs-tx trim value\n"); 580 586 return; 581 587 } ··· 589 583 /* Fused TUNE1/2 value is the higher nibble only */ 590 584 if (cfg->update_tune1_with_efuse) 591 585 qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE1], 592 - val[0] << HSTX_TRIM_SHIFT, 593 - HSTX_TRIM_MASK); 586 + hstx_trim << HSTX_TRIM_SHIFT, HSTX_TRIM_MASK); 594 587 else 595 588 qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE2], 596 - val[0] << HSTX_TRIM_SHIFT, 597 - HSTX_TRIM_MASK); 589 + hstx_trim << HSTX_TRIM_SHIFT, HSTX_TRIM_MASK); 598 590 } 599 591 600 592 static int qusb2_phy_set_mode(struct phy *phy,