[PATCH] ACPI: scan: fix bus ID cleanup on device_add() failure

[PATCH] ACPI: scan: fix bus ID cleanup on device_add() failure

[Hongyan Xu]

When device_add() fails after acpi_device_set_name() has allocated an
instance ID and linked a new acpi_device_bus_id into
acpi_bus_id_list, the rollback path only removes wakeup_list and
detaches the ACPI handle data.

That leaves the bus-ID bookkeeping behind and keeps the allocated
instance number consumed.

Factor the bus-ID removal into a helper, use it from both the normal
device teardown path and the device_add() rollback path, and only drop
wakeup_list when it was actually linked.

Found by manual review of reports from the
kernel70rc2-fail11-retry-20260801 run.

Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
 drivers/acpi/scan.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index ff7000b71..852682436 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -520,12 +520,10 @@ static void acpi_device_release(struct device *dev)
 	kfree(acpi_dev);
 }
 
-static void acpi_device_del(struct acpi_device *device)
+static void acpi_device_remove_bus_id(struct acpi_device *device)
 {
 	struct acpi_device_bus_id *acpi_device_bus_id;
 
-	mutex_lock(&acpi_device_lock);
-
 	list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node)
 		if (!strcmp(acpi_device_bus_id->bus_id,
 			    acpi_device_hid(device))) {
@@ -538,8 +536,16 @@ static void acpi_device_del(struct acpi_device *device)
 			}
 			break;
 		}
+}
 
-	list_del(&device->wakeup_list);
+static void acpi_device_del(struct acpi_device *device)
+{
+	mutex_lock(&acpi_device_lock);
+
+	acpi_device_remove_bus_id(device);
+
+	if (device->wakeup.flags.valid)
+		list_del(&device->wakeup_list);
 
 	mutex_unlock(&acpi_device_lock);
 
@@ -800,7 +806,9 @@ int acpi_device_add(struct acpi_device *device)
 err:
 	mutex_lock(&acpi_device_lock);
 
-	list_del(&device->wakeup_list);
+	acpi_device_remove_bus_id(device);
+	if (device->wakeup.flags.valid)
+		list_del(&device->wakeup_list);
 
 err_unlock:
 	mutex_unlock(&acpi_device_lock);
-- 
2.50.1.windows.1

Re: [PATCH] ACPI: scan: fix bus ID cleanup on device_add() failure

[Rafael J. Wysocki (Intel)]

On Tue, Aug 4, 2026 at 5:49 PM Hongyan Xu <getshell@seu.edu.cn> wrote:
>
> When device_add() fails after acpi_device_set_name() has allocated an
> instance ID and linked a new acpi_device_bus_id into
> acpi_bus_id_list, the rollback path only removes wakeup_list and
> detaches the ACPI handle data.
>
> That leaves the bus-ID bookkeeping behind and keeps the allocated
> instance number consumed.
>
> Factor the bus-ID removal into a helper, use it from both the normal
> device teardown path and the device_add() rollback path, and only drop
> wakeup_list when it was actually linked.
>
> Found by manual review of reports from the
> kernel70rc2-fail11-retry-20260801 run.
>
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
> ---
>  drivers/acpi/scan.c | 18 +++++++++++++-----
>  1 file changed, 13 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
> index ff7000b71..852682436 100644
> --- a/drivers/acpi/scan.c
> +++ b/drivers/acpi/scan.c
> @@ -520,12 +520,10 @@ static void acpi_device_release(struct device *dev)
>         kfree(acpi_dev);
>  }
>
> -static void acpi_device_del(struct acpi_device *device)
> +static void acpi_device_remove_bus_id(struct acpi_device *device)
>  {
>         struct acpi_device_bus_id *acpi_device_bus_id;
>
> -       mutex_lock(&acpi_device_lock);
> -
>         list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node)
>                 if (!strcmp(acpi_device_bus_id->bus_id,
>                             acpi_device_hid(device))) {
> @@ -538,8 +536,16 @@ static void acpi_device_del(struct acpi_device *device)
>                         }
>                         break;
>                 }
> +}
>
> -       list_del(&device->wakeup_list);
> +static void acpi_device_del(struct acpi_device *device)
> +{
> +       mutex_lock(&acpi_device_lock);
> +
> +       acpi_device_remove_bus_id(device);
> +
> +       if (device->wakeup.flags.valid)
> +               list_del(&device->wakeup_list);
>
>         mutex_unlock(&acpi_device_lock);
>
> @@ -800,7 +806,9 @@ int acpi_device_add(struct acpi_device *device)
>  err:
>         mutex_lock(&acpi_device_lock);
>
> -       list_del(&device->wakeup_list);
> +       acpi_device_remove_bus_id(device);
> +       if (device->wakeup.flags.valid)
> +               list_del(&device->wakeup_list);

You have exactly the same code sequence in two places, so any chance
to avoid that duplication?

Also, it is not necessary to check device->wakeup.flags.valid before
doing list_del(&device->wakeup_list) if I'm not mistaken.

>
>  err_unlock:
>         mutex_unlock(&acpi_device_lock);
> --

[PATCH v2] ACPI: scan: fix bus ID cleanup on device_add() failure

[Hongyan Xu]

When device_add() fails after acpi_device_set_name() has allocated an
instance ID and linked a new acpi_device_bus_id into acpi_bus_id_list, the
rollback path only removes wakeup_list and detaches the ACPI handle data.

That leaves the bus-ID bookkeeping behind and keeps the allocated instance
number consumed.

Move the bus-ID cleanup and wakeup-list removal into a single helper.
Use it from both the normal device teardown path and the device_add()
rollback path. The wakeup list node is initialized before registration, so
it can be deleted without checking whether the device is wakeup-capable, as
in the original teardown path.

Found by manual review of reports from the
kernel70rc2-fail11-retry-20260801 run.

Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
v2:
- Fold the bus-ID cleanup and wakeup-list removal into one helper to avoid
  duplicating the same sequence in acpi_device_del() and the device_add()
  rollback path.
- Drop the wakeup.flags.valid check before list_del(&device->wakeup_list).

v1: https://lore.kernel.org/linux-acpi/20260804154854.1555-1-getshell@seu.edu.cn/

 drivers/acpi/scan.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index ff7000b71fd1..a311af60d8d3 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -520,12 +520,10 @@ static void acpi_device_release(struct device *dev)
 	kfree(acpi_dev);
 }
 
-static void acpi_device_del(struct acpi_device *device)
+static void acpi_device_del_list(struct acpi_device *device)
 {
 	struct acpi_device_bus_id *acpi_device_bus_id;
 
-	mutex_lock(&acpi_device_lock);
-
 	list_for_each_entry(acpi_device_bus_id, &acpi_bus_id_list, node)
 		if (!strcmp(acpi_device_bus_id->bus_id,
 			    acpi_device_hid(device))) {
@@ -540,6 +538,13 @@ static void acpi_device_del(struct acpi_device *device)
 		}
 
 	list_del(&device->wakeup_list);
+}
+
+static void acpi_device_del(struct acpi_device *device)
+{
+	mutex_lock(&acpi_device_lock);
+
+	acpi_device_del_list(device);
 
 	mutex_unlock(&acpi_device_lock);
 
@@ -800,7 +805,7 @@ int acpi_device_add(struct acpi_device *device)
 err:
 	mutex_lock(&acpi_device_lock);
 
-	list_del(&device->wakeup_list);
+	acpi_device_del_list(device);
 
 err_unlock:
 	mutex_unlock(&acpi_device_lock);
-- 
2.50.1.windows.1