Commit 01af542392b5 ("usb: ulpi: fix double free in
ulpi_register_interface() error path") removed kfree(ulpi) from
ulpi_register_interface() to fix a double-free when device_register()
fails.

But when ulpi_of_register() or ulpi_read_id() fail before
device_register() is called, the ulpi allocation is leaked.

Add kfree(ulpi) on both error paths to properly clean up the allocation.

Fixes: 01af542392b5 ("usb: ulpi: fix double free in ulpi_register_interface() error path")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
---
 drivers/usb/common/ulpi.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c
index b34fb65813c4..9b69148128e5 100644
--- a/drivers/usb/common/ulpi.c
+++ b/drivers/usb/common/ulpi.c
@@ -286,12 +286,15 @@ static int ulpi_register(struct device *dev, struct ulpi *ulpi)
 	ACPI_COMPANION_SET(&ulpi->dev, ACPI_COMPANION(dev));
 
 	ret = ulpi_of_register(ulpi);
-	if (ret)
+	if (ret) {
+		kfree(ulpi);
 		return ret;
+	}
 
 	ret = ulpi_read_id(ulpi);
 	if (ret) {
 		of_node_put(ulpi->dev.of_node);
+		kfree(ulpi);
 		return ret;
 	}
 

---
base-commit: 816f193dd0d95246f208590924dd962b192def78
change-id: 20260407-ulpi-25d4859c0954

Best regards,
-- 
Felix Gu <ustc.gu@gmail.com>

On Tue, Apr 07, 2026 at 09:21:22PM +0800, Felix Gu wrote:
> Commit 01af542392b5 ("usb: ulpi: fix double free in
> ulpi_register_interface() error path") removed kfree(ulpi) from
> ulpi_register_interface() to fix a double-free when device_register()
> fails.
> 
> But when ulpi_of_register() or ulpi_read_id() fail before
> device_register() is called, the ulpi allocation is leaked.
> 
> Add kfree(ulpi) on both error paths to properly clean up the allocation.
> 
> Fixes: 01af542392b5 ("usb: ulpi: fix double free in ulpi_register_interface() error path")
> Signed-off-by: Felix Gu <ustc.gu@gmail.com>

Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
>  drivers/usb/common/ulpi.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c
> index b34fb65813c4..9b69148128e5 100644
> --- a/drivers/usb/common/ulpi.c
> +++ b/drivers/usb/common/ulpi.c
> @@ -286,12 +286,15 @@ static int ulpi_register(struct device *dev, struct ulpi *ulpi)
>  	ACPI_COMPANION_SET(&ulpi->dev, ACPI_COMPANION(dev));
>  
>  	ret = ulpi_of_register(ulpi);
> -	if (ret)
> +	if (ret) {
> +		kfree(ulpi);
>  		return ret;
> +	}
>  
>  	ret = ulpi_read_id(ulpi);
>  	if (ret) {
>  		of_node_put(ulpi->dev.of_node);
> +		kfree(ulpi);
>  		return ret;
>  	}
>  

-- 
heikki