[bug report] firmware: drivers: imx: adds miscdev

[Dan Carpenter <error27@gmail.com>]

Hello Pankaj Gupta,

Commit 4de71839142b ("firmware: drivers: imx: adds miscdev") from Jan
22, 2026 (linux-next), leads to the following Smatch static checker
warning:

	drivers/firmware/imx/se_ctrl.c:490 init_device_context()
	warn: '&dev_ctx->link' not removed from list

drivers/firmware/imx/se_ctrl.c
    461 static int init_device_context(struct se_if_priv *priv, int ch_id,
    462                                struct se_if_device_ctx **new_dev_ctx)
    463 {
    464         struct se_if_device_ctx *dev_ctx;
    465         int ret = 0;
    466 
    467         dev_ctx = kzalloc(sizeof(*dev_ctx), GFP_KERNEL);
    468 
    469         if (!dev_ctx)
    470                 return -ENOMEM;
    471 
    472         dev_ctx->devname = kasprintf(GFP_KERNEL, "%s0_ch%d",
    473                                      get_se_if_name(priv->if_defs->se_if_type),
    474                                      ch_id);
    475         if (!dev_ctx->devname) {
    476                 kfree(dev_ctx);
    477                 return -ENOMEM;
    478         }
    479 
    480         mutex_init(&dev_ctx->fops_lock);
    481         dev_ctx->priv = priv;
    482         *new_dev_ctx = dev_ctx;
    483 
    484         list_add_tail(&dev_ctx->link, &priv->dev_ctx_list);
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
This adds dev_ctx to the list

    485         priv->active_devctx_count++;
    486 
    487         ret = init_se_shared_mem(dev_ctx);
    488         if (ret < 0) {
    489                 kfree(dev_ctx->devname);
--> 490                 kfree(dev_ctx);

But it's still on the list when we free it so it leads to a use after
free.

    491                 *new_dev_ctx = NULL;
    492         }
    493 
    494         return ret;
    495 }

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter