The reference obtained by calling usb_get_dev() is not released in the
gpio_mpsse_probe() error paths. Fix that by calling usb_put_dev().

Cc: stable@vger.kernel.org
Fixes: c46a74ff05c0 ("gpio: add support for FTDI's MPSSE as GPIO")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
Compile tested only. Issue found using static analysis.

 drivers/gpio/gpio-mpsse.c | 37 +++++++++++++++++++++++--------------
 1 file changed, 23 insertions(+), 14 deletions(-)

diff --git a/drivers/gpio/gpio-mpsse.c b/drivers/gpio/gpio-mpsse.c
index ace652ba4df1..b473db9c3c4d 100644
--- a/drivers/gpio/gpio-mpsse.c
+++ b/drivers/gpio/gpio-mpsse.c
@@ -596,24 +596,26 @@ static int gpio_mpsse_probe(struct usb_interface *interface,
 	priv->intf_id = interface->cur_altsetting->desc.bInterfaceNumber;
 
 	priv->id = ida_alloc(&gpio_mpsse_ida, GFP_KERNEL);
-	if (priv->id < 0)
-		return priv->id;
+	if (priv->id < 0) {
+		err = priv->id;
+		goto error;
+	}
 
 	err = devm_add_action_or_reset(dev, gpio_mpsse_ida_remove, priv);
 	if (err)
-		return err;
+		goto error;
 
 	err = devm_mutex_init(dev, &priv->io_mutex);
 	if (err)
-		return err;
+		goto error;
 
 	err = devm_mutex_init(dev, &priv->irq_mutex);
 	if (err)
-		return err;
+		goto error;
 
 	err = devm_mutex_init(dev, &priv->irq_race);
 	if (err)
-		return err;
+		goto error;
 
 	raw_spin_lock_init(&priv->irq_spin);
 
@@ -626,8 +628,10 @@ static int gpio_mpsse_probe(struct usb_interface *interface,
 					  id->idVendor, id->idProduct,
 					  priv->intf_id, priv->id,
 					  serial);
-	if (!priv->gpio.label)
-		return -ENOMEM;
+	if (!priv->gpio.label) {
+		err = -ENOMEM;
+		goto error;
+	}
 
 	priv->gpio.owner = THIS_MODULE;
 	priv->gpio.parent = interface->usb_dev;
@@ -657,12 +661,14 @@ static int gpio_mpsse_probe(struct usb_interface *interface,
 					&priv->bulk_in, &priv->bulk_out,
 					NULL, NULL);
 	if (err)
-		return err;
+		goto error;
 
 	priv->bulk_in_buf = devm_kmalloc(dev, usb_endpoint_maxp(priv->bulk_in),
 					 GFP_KERNEL);
-	if (!priv->bulk_in_buf)
-		return -ENOMEM;
+	if (!priv->bulk_in_buf) {
+		err = -ENOMEM;
+		goto error;
+	}
 
 	usb_set_intfdata(interface, priv);
 
@@ -673,7 +679,7 @@ static int gpio_mpsse_probe(struct usb_interface *interface,
 			      MODE_RESET, priv->intf_id + 1, NULL, 0,
 			      USB_CTRL_SET_TIMEOUT);
 	if (err)
-		return err;
+		goto error;
 
 	/* Enter MPSSE mode */
 	err = usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
@@ -682,7 +688,7 @@ static int gpio_mpsse_probe(struct usb_interface *interface,
 			      MODE_MPSSE, priv->intf_id + 1, NULL, 0,
 			      USB_CTRL_SET_TIMEOUT);
 	if (err)
-		return err;
+		goto error;
 
 	gpio_irq_chip_set_chip(&priv->gpio.irq, &gpio_mpsse_irq_chip);
 
@@ -695,9 +701,12 @@ static int gpio_mpsse_probe(struct usb_interface *interface,
 
 	err = devm_gpiochip_add_data(dev, &priv->gpio, priv);
 	if (err)
-		return err;
+		goto error;
 
 	return 0;
+error:
+	usb_put_dev(priv->udev);
+	return err;
 }
 
 static void gpio_mpsse_disconnect(struct usb_interface *intf)
-- 
2.43.0

On Tue, Dec 23, 2025 at 7:53 AM Abdun Nihaal <nihaal@cse.iitm.ac.in> wrote:
>
> The reference obtained by calling usb_get_dev() is not released in the
> gpio_mpsse_probe() error paths. Fix that by calling usb_put_dev().
>
> Cc: stable@vger.kernel.org
> Fixes: c46a74ff05c0 ("gpio: add support for FTDI's MPSSE as GPIO")
> Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
> ---
> Compile tested only. Issue found using static analysis.
>

Hi!

The same should be done when the driver is unbound. Can you simplify
your patch by using devm_add_action_or_reset() instead? That way you
avoid all the gotos.

Bart