ux500_musb_init() takes a reference on the USB2 transceiver with
usb_get_phy() and stores it in musb->xceiv. If the subsequent
usb_register_notifier() call fails, the function returns without
releasing the reference, leaking the transceiver. The only place the
reference is put is ux500_musb_exit(), which is not run when the init
fails.

Put the transceiver before returning on the notifier registration
failure path. The notifier itself does not need to be unregistered
since usb_register_notifier() failed.

Fixes: 0135522c4898 ("usb: musb: ux500: add otg notifier support")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/usb/musb/ux500.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/musb/ux500.c b/drivers/usb/musb/ux500.c
index 8c2a43d992f5..14c5e986937e 100644
--- a/drivers/usb/musb/ux500.c
+++ b/drivers/usb/musb/ux500.c
@@ -155,6 +155,7 @@ static int ux500_musb_init(struct musb *musb)
 	status = usb_register_notifier(musb->xceiv, &musb->nb);
 	if (status < 0) {
 		dev_dbg(musb->controller, "notification register failed\n");
+		usb_put_phy(musb->xceiv);
 		return status;
 	}
 
-- 
2.34.1

On Wed, Sep 16, 2026 at 04:50:55PM +0000, Wentao Liang wrote:
> ux500_musb_init() takes a reference on the USB2 transceiver with
> usb_get_phy() and stores it in musb->xceiv. If the subsequent
> usb_register_notifier() call fails, the function returns without
> releasing the reference, leaking the transceiver. The only place the
> reference is put is ux500_musb_exit(), which is not run when the init
> fails.
> 
> Put the transceiver before returning on the notifier registration
> failure path. The notifier itself does not need to be unregistered
> since usb_register_notifier() failed.
> 
> Fixes: 0135522c4898 ("usb: musb: ux500: add otg notifier support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/usb/musb/ux500.c | 1 +
>  1 file changed, 1 insertion(+)

Again, you need to add an assisted-by tag.  Please go back and fix up
_ALL_ of these to have that.

thanks,

greg k-h

On Wed, Sep 16, 2026 at 6:51 PM Wentao Liang <vulab@iscas.ac.cn> wrote:

> ux500_musb_init() takes a reference on the USB2 transceiver with
> usb_get_phy() and stores it in musb->xceiv. If the subsequent
> usb_register_notifier() call fails, the function returns without
> releasing the reference, leaking the transceiver. The only place the
> reference is put is ux500_musb_exit(), which is not run when the init
> fails.
>
> Put the transceiver before returning on the notifier registration
> failure path. The notifier itself does not need to be unregistered
> since usb_register_notifier() failed.
>
> Fixes: 0135522c4898 ("usb: musb: ux500: add otg notifier support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Reviewed-by: Linus Walleij <linusw@kernel.org>

Yours,
Linus Walleij