[PATCH v1] PNP: Fix card device cleanup on registration failure

[PATCH v1] PNP: Fix card device cleanup on registration failure

[Yuho Choi]

pnp_add_card() ignores __pnp_add_device() failures. If device_register()
fails there, the device is removed from the global and protocol lists, but
remains on the card list and its device reference is not dropped.

Remove the failed device from the card list and call put_device() before
continuing with the remaining card devices.

Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---
 drivers/pnp/card.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/pnp/card.c b/drivers/pnp/card.c
index 87f5af454751..df5e3d3cbf6c 100644
--- a/drivers/pnp/card.c
+++ b/drivers/pnp/card.c
@@ -254,9 +254,16 @@ int pnp_add_card(struct pnp_card *card)
 	/* we wait until now to add devices in order to ensure the drivers
 	 * will be able to use all of the related devices on the card
 	 * without waiting an unreasonable length of time */
-	list_for_each(pos, &card->devices) {
+	list_for_each_safe(pos, temp, &card->devices) {
 		struct pnp_dev *dev = card_to_pnp_dev(pos);
-		__pnp_add_device(dev);
+		error = __pnp_add_device(dev);
+		if (error) {
+			mutex_lock(&pnp_lock);
+			list_del(&dev->card_list);
+			dev->card = NULL;
+			mutex_unlock(&pnp_lock);
+			put_device(&dev->dev);
+		}
 	}
 
 	/* match with card drivers */
-- 
2.43.0

Re: [PATCH v1] PNP: Fix card device cleanup on registration failure

[Rafael J. Wysocki (Intel)]

On Fri, Jul 3, 2026 at 5:36 AM Yuho Choi <dbgh9129@gmail.com> wrote:
>
> pnp_add_card() ignores __pnp_add_device() failures. If device_register()
> fails there, the device is removed from the global and protocol lists, but
> remains on the card list and its device reference is not dropped.
>
> Remove the failed device from the card list and call put_device() before
> continuing with the remaining card devices.
>
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
> ---
>  drivers/pnp/card.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/pnp/card.c b/drivers/pnp/card.c
> index 87f5af454751..df5e3d3cbf6c 100644
> --- a/drivers/pnp/card.c
> +++ b/drivers/pnp/card.c
> @@ -254,9 +254,16 @@ int pnp_add_card(struct pnp_card *card)
>         /* we wait until now to add devices in order to ensure the drivers
>          * will be able to use all of the related devices on the card
>          * without waiting an unreasonable length of time */
> -       list_for_each(pos, &card->devices) {
> +       list_for_each_safe(pos, temp, &card->devices) {
>                 struct pnp_dev *dev = card_to_pnp_dev(pos);
> -               __pnp_add_device(dev);
> +               error = __pnp_add_device(dev);
> +               if (error) {
> +                       mutex_lock(&pnp_lock);
> +                       list_del(&dev->card_list);
> +                       dev->card = NULL;
> +                       mutex_unlock(&pnp_lock);
> +                       put_device(&dev->dev);
> +               }
>         }
>
>         /* match with card drivers */
> --

Applied as 7.3 material, thanks!