[PATCH] phy: usb: Fix USB 3.0 clock reference leak in brcm_usb_phy_dvr_init()

[PATCH] phy: usb: Fix USB 3.0 clock reference leak in brcm_usb_phy_dvr_init()

[Wentao Liang]

brcm_usb_phy_dvr_init() obtains usb_30_clk with of_clk_get_by_name(),
which takes a reference on the clock, but returns without calling
clk_put() when clk_prepare_enable() fails, when the suspend clock
request is deferred, or when devm_request_irq() fails.  The clock is
only handed to the driver on the success path, so nothing releases the
reference on these paths.

Drop it from the err_put_clks label, and clear usb_30_clk on the
-EPROBE_DEFER path where it holds an error pointer rather than a
reference.

Fixes: 49859e55e364 ("phy: usb: phy-brcm-usb: Add Broadcom STB USB phy driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/phy/broadcom/phy-brcm-usb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/phy/broadcom/phy-brcm-usb.c b/drivers/phy/broadcom/phy-brcm-usb.c
index 8ef8aa025789..d411512b1036 100644
--- a/drivers/phy/broadcom/phy-brcm-usb.c
+++ b/drivers/phy/broadcom/phy-brcm-usb.c
@@ -443,6 +443,7 @@ static int brcm_usb_phy_dvr_init(struct platform_device *pdev,
 		priv->usb_30_clk = of_clk_get_by_name(dn, "sw_usb3");
 		if (IS_ERR(priv->usb_30_clk)) {
 			if (PTR_ERR(priv->usb_30_clk) == -EPROBE_DEFER) {
+				priv->usb_30_clk = NULL;
 				err = -EPROBE_DEFER;
 				goto err_put_clks;
 			}
@@ -483,6 +484,7 @@ static int brcm_usb_phy_dvr_init(struct platform_device *pdev,
 	return 0;
 
 err_put_clks:
+	clk_put(priv->usb_30_clk);
 	clk_put(priv->usb_20_clk);
 	return err;
 }
-- 
2.34.1

Re: [PATCH] phy: usb: Fix USB 3.0 clock reference leak in brcm_usb_phy_dvr_init()

[Manivannan Sadhasivam]

On Thu, Sep 17, 2026 at 01:36:51PM +0000, Wentao Liang wrote:
> brcm_usb_phy_dvr_init() obtains usb_30_clk with of_clk_get_by_name(),
> which takes a reference on the clock, but returns without calling
> clk_put() when clk_prepare_enable() fails, when the suspend clock
> request is deferred, or when devm_request_irq() fails.  The clock is
> only handed to the driver on the success path, so nothing releases the
> reference on these paths.
> 
> Drop it from the err_put_clks label, and clear usb_30_clk on the
> -EPROBE_DEFER path where it holds an error pointer rather than a
> reference.
> 
> Fixes: 49859e55e364 ("phy: usb: phy-brcm-usb: Add Broadcom STB USB phy driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Same comment as previous patch. Handle all leaks in one patch.

- Mani

-- 
மணிவண்ணன் சதாசிவம்