USB: MUSB: fix kernel WARNING/oops when unloading module in OTG mode

Since commit 461972d8a4c94bc44f11a13046041c78a7cf18dd (musb_core: don't call
musb_platform_exit() twice), unloading the driver module results in a WARNING
"kobject: '(null)' (c73de788): is not initialized, yet kobject_put() is being
called." (or even kernel oops) on e.g. DaVincis, though only in the OTG mode.
There exists dubious and unbalanced put_device() call in musb_free() which
takes place only in the OTG mode.  As this commit caused musb_platform_exit()
to be called (and so unregister the NOP transceiver) before this put_device()
call, this function references already freed memory.

On the other hand, all the glue layers miss the otg_put_transceiver() call,
complementary to the otg_get_transceiver() call that they do.  So, I think
the solution is to get rid of the strange put_device() call, and instead
call otg_put_transceiver() in the glue layers...

Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 4 insertions, 0 deletions

diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index 3c48e77a0aa2..bde40efc7046 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -1152,6 +1152,8 @@ done:
         if (ret < 0) {
                 if (sync)
                         iounmap(sync);
+
+                otg_put_transceiver(musb->xceiv);
                 usb_nop_xceiv_unregister();
         }
         return ret;
@@ -1166,6 +1168,8 @@ int musb_platform_exit(struct musb *musb)
                 musb->board_set_power(0);
 
         iounmap(musb->sync_va);
+
+        otg_put_transceiver(musb->xceiv);
         usb_nop_xceiv_unregister();
         return 0;
 }