isp1760_init() ignores the return value of isp1760_init_kmem_once(). If creating the isp1760_qtd or isp1760_qh cache fails, the error path in isp1760_init_kmem_once() destroys the caches that were already created, but the global pointers keep pointing to the freed kmem_cache structures: urb_listitem_cachep when the qtd cache creation fails, and both urb_listitem_cachep and qtd_cachep when the qh cache creation fails. Module init still succeeds as long as one of the driver registrations succeeds, so the driver stays loaded with dangling cache pointers. When the module is unloaded later, isp1760_exit() calls isp1760_deinit_kmem_cache(), which destroys the already freed caches a second time. A controller probed in the meantime would also allocate qTDs and QHs from freed or NULL caches. Propagate the error from isp1760_init_kmem_once() so that module load fails cleanly instead. Fixes: db11e47dd7b0 ("USB: ISP1760 HCD driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Shuangpeng Bai --- drivers/usb/isp1760/isp1760-if.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/usb/isp1760/isp1760-if.c b/drivers/usb/isp1760/isp1760-if.c index a64190addba6..bf33289bfcd4 100644 --- a/drivers/usb/isp1760/isp1760-if.c +++ b/drivers/usb/isp1760/isp1760-if.c @@ -274,7 +274,9 @@ static int __init isp1760_init(void) { int ret, any_ret = -ENODEV; - isp1760_init_kmem_once(); + ret = isp1760_init_kmem_once(); + if (ret) + return ret; ret = platform_driver_register(&isp1760_plat_driver); if (!ret) -- 2.43.0