[PATCH v2 0/3] Convert manual kfree(dev) to put_device()

[PATCH v2 0/3] Convert manual kfree(dev) to put_device()

[Tarun Sahu]

Hello,

As per the guidelines, Devices that are tried to register with
device_register or to add using device_add, must use put_device
on their failure path (not kfree). This series contains 3 patches
for updating such instances.

V2 <- V1
1. Removed patch [1] as it is part of another series [2] already.

[1]: https://lore.kernel.org/all/20260810162814.1398016-4-tarunsahu@google.com/
[2]: https://lore.kernel.org/all/20260724171945.2812749-5-shubhrajyoti.datta@amd.com/

Tarun Sahu (3):
  ARM: locomo: use put_device() on device_register() failure
  firmware/edd: use kobject_put() on edd_device_register() failure
  powerpc/ps3: use put_device() on device_register() failure in
    ps3_system_bus_device_register

 arch/arm/common/locomo.c                 | 13 ++--
 arch/powerpc/platforms/ps3/device-init.c | 83 ++++++++++++++----------
 arch/powerpc/platforms/ps3/system-bus.c  |  2 +
 drivers/firmware/edd.c                   |  2 +-
 4 files changed, 59 insertions(+), 41 deletions(-)


base-commit: dbaafe9cc56a996931eedfe043eb34418cc9cd9b
-- 
2.55.0.699.gb54405d56f-goog

[PATCH v2 1/3] ARM: locomo: use put_device() on device_register() failure

[Tarun Sahu]

When device_register() fails, calling kfree(dev) directly bypasses the
device_release() callback (locomo_dev_release) and leaks internal driver
core structures allocated during device initialization.

Fix this by replacing direct kfree(dev) with put_device(&dev->dev) when
device_register() returns an error, ensuring proper refcount decrement
and cleanup via locomo_dev_release().

Signed-off-by: Tarun Sahu <tarunsahu@google.com>
---
 arch/arm/common/locomo.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/arch/arm/common/locomo.c b/arch/arm/common/locomo.c
index 55e360452828..0f6689d343b0 100644
--- a/arch/arm/common/locomo.c
+++ b/arch/arm/common/locomo.c
@@ -223,10 +223,8 @@ locomo_init_one_child(struct locomo *lchip, struct locomo_dev_info *info)
 	int ret;
 
 	dev = kzalloc_obj(struct locomo_dev);
-	if (!dev) {
-		ret = -ENOMEM;
-		goto out;
-	}
+	if (!dev)
+		return -ENOMEM;
 
 	/*
 	 * If the parent device has a DMA mask associated with it,
@@ -255,10 +253,11 @@ locomo_init_one_child(struct locomo *lchip, struct locomo_dev_info *info)
 
 	ret = device_register(&dev->dev);
 	if (ret) {
- out:
-		kfree(dev);
+		put_device(&dev->dev);
+		return ret;
 	}
-	return ret;
+
+	return 0;
 }
 
 #ifdef CONFIG_PM
-- 
2.55.0.699.gb54405d56f-goog

[PATCH v2 2/3] firmware/edd: use kobject_put() on edd_device_register() failure

[Tarun Sahu]

When edd_device_register() fails after initializing the kobject with
kobject_init_and_add(), calling kfree(edev) directly bypasses the
kobject release callback (edd_release) and leaks the allocated kobject
resources.

Fix this by replacing direct kfree(edev) with kobject_put(&edev->kobj) on
registration failure.

Signed-off-by: Tarun Sahu <tarunsahu@google.com>
---
 drivers/firmware/edd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/edd.c b/drivers/firmware/edd.c
index f980c5b56858..763e7b16d517 100644
--- a/drivers/firmware/edd.c
+++ b/drivers/firmware/edd.c
@@ -748,7 +748,7 @@ edd_init(void)
 
 		rc = edd_device_register(edev, i);
 		if (rc) {
-			kfree(edev);
+			kobject_put(&edev->kobj);
 			goto out;
 		}
 		edd_devices[i] = edev;
-- 
2.55.0.699.gb54405d56f-goog

[PATCH v2 3/3] powerpc/ps3: use put_device() on device_register() failure in ps3_system_bus_device_register

[Tarun Sahu]

When device_register() fails, calling put_device() ensures that the
device reference count drops to 0, which invokes the release callback
ps3_system_bus_release_device() to cleanly free the device and its
associated driver core resources.

Signed-off-by: Tarun Sahu <tarunsahu@google.com>
---
 arch/powerpc/platforms/ps3/device-init.c | 83 ++++++++++++++----------
 arch/powerpc/platforms/ps3/system-bus.c  |  2 +
 2 files changed, 52 insertions(+), 33 deletions(-)

diff --git a/arch/powerpc/platforms/ps3/device-init.c b/arch/powerpc/platforms/ps3/device-init.c
index 9109c218a060..8d0c77db1764 100644
--- a/arch/powerpc/platforms/ps3/device-init.c
+++ b/arch/powerpc/platforms/ps3/device-init.c
@@ -90,14 +90,12 @@ static int __init ps3_register_lpm_devices(void)
 	if (result) {
 		pr_debug("%s:%d ps3_system_bus_device_register failed\n",
 			__func__, __LINE__);
-		goto fail_register;
+		return result;
 	}
 
 	pr_debug(" <- %s:%d\n", __func__, __LINE__);
 	return 0;
 
-
-fail_register:
 fail_rights:
 fail_read_repo:
 	kfree(dev);
@@ -121,6 +119,12 @@ static int __init ps3_setup_gelic_device(
 		struct ps3_dma_region d_region;
 	} *p;
 
+	/*
+	 * ps3_system_bus_release_device() calls kfree(&p->dev).
+	 * dev must be at offset 0 so kfree() frees outer p.
+	 */
+	BUILD_BUG_ON(offsetof(struct layout, dev) != 0);
+
 	pr_debug(" -> %s:%d\n", __func__, __LINE__);
 
 	BUG_ON(repo->bus_type != PS3_BUS_TYPE_SB);
@@ -164,13 +168,12 @@ static int __init ps3_setup_gelic_device(
 	if (result) {
 		pr_debug("%s:%d ps3_system_bus_device_register failed\n",
 			__func__, __LINE__);
-		goto fail_device_register;
+		return result;
 	}
 
 	pr_debug(" <- %s:%d\n", __func__, __LINE__);
 	return result;
 
-fail_device_register:
 fail_dma_init:
 fail_find_interrupt:
 	kfree(p);
@@ -192,6 +195,12 @@ static int __init ps3_setup_uhc_device(
 	u64 bus_addr;
 	u64 len;
 
+	/*
+	 * ps3_system_bus_release_device() calls kfree(&p->dev).
+	 * dev must be at offset 0 so kfree() frees outer p.
+	 */
+	BUILD_BUG_ON(offsetof(struct layout, dev) != 0);
+
 	pr_debug(" -> %s:%d\n", __func__, __LINE__);
 
 	BUG_ON(repo->bus_type != PS3_BUS_TYPE_SB);
@@ -252,13 +261,12 @@ static int __init ps3_setup_uhc_device(
 	if (result) {
 		pr_debug("%s:%d ps3_system_bus_device_register failed\n",
 			__func__, __LINE__);
-		goto fail_device_register;
+		return result;
 	}
 
 	pr_debug(" <- %s:%d\n", __func__, __LINE__);
 	return result;
 
-fail_device_register:
 fail_mmio_init:
 fail_dma_init:
 fail_find_reg:
@@ -291,6 +299,12 @@ static int __init ps3_setup_vuart_device(enum ps3_match_id match_id,
 		struct ps3_system_bus_device dev;
 	} *p;
 
+	/*
+	 * ps3_system_bus_release_device() calls kfree(&p->dev).
+	 * dev must be at offset 0 so kfree() frees outer p.
+	 */
+	BUILD_BUG_ON(offsetof(struct layout, dev) != 0);
+
 	pr_debug(" -> %s:%d: match_id %u, port %u\n", __func__, __LINE__,
 		match_id, port_number);
 
@@ -308,15 +322,10 @@ static int __init ps3_setup_vuart_device(enum ps3_match_id match_id,
 	if (result) {
 		pr_debug("%s:%d ps3_system_bus_device_register failed\n",
 			__func__, __LINE__);
-		goto fail_device_register;
+		return result;
 	}
 	pr_debug(" <- %s:%d\n", __func__, __LINE__);
 	return 0;
-
-fail_device_register:
-	kfree(p);
-	pr_debug(" <- %s:%d fail\n", __func__, __LINE__);
-	return result;
 }
 
 static int ps3_setup_storage_dev(const struct ps3_repository_device *repo,
@@ -327,6 +336,12 @@ static int ps3_setup_storage_dev(const struct ps3_repository_device *repo,
 	u64 port, blk_size, num_blocks;
 	unsigned int num_regions, i;
 
+	/*
+	 * ps3_system_bus_release_device() calls kfree(&p->sbd).
+	 * sbd must be at offset 0 so kfree() frees outer p.
+	 */
+	BUILD_BUG_ON(offsetof(struct ps3_storage_device, sbd) != 0);
+
 	pr_debug(" -> %s:%u: match_id %u\n", __func__, __LINE__, match_id);
 
 	result = ps3_repository_read_stor_dev_info(repo->bus_index,
@@ -395,13 +410,12 @@ static int ps3_setup_storage_dev(const struct ps3_repository_device *repo,
 	if (result) {
 		pr_debug("%s:%u ps3_system_bus_device_register failed\n",
 			 __func__, __LINE__);
-		goto fail_device_register;
+		return result;
 	}
 
 	pr_debug(" <- %s:%u\n", __func__, __LINE__);
 	return 0;
 
-fail_device_register:
 fail_read_region:
 fail_find_interrupt:
 	kfree(p);
@@ -445,6 +459,12 @@ static int __init ps3_register_sound_devices(void)
 		struct ps3_mmio_region m_region;
 	} *p;
 
+	/*
+	 * ps3_system_bus_release_device() calls kfree(&p->dev).
+	 * dev must be at offset 0 so kfree() frees outer p.
+	 */
+	BUILD_BUG_ON(offsetof(struct layout, dev) != 0);
+
 	pr_debug(" -> %s:%d\n", __func__, __LINE__);
 
 	p = kzalloc_obj(*p);
@@ -461,15 +481,10 @@ static int __init ps3_register_sound_devices(void)
 	if (result) {
 		pr_debug("%s:%d ps3_system_bus_device_register failed\n",
 			__func__, __LINE__);
-		goto fail_device_register;
+		return result;
 	}
 	pr_debug(" <- %s:%d\n", __func__, __LINE__);
 	return 0;
-
-fail_device_register:
-	kfree(p);
-	pr_debug(" <- %s:%d failed\n", __func__, __LINE__);
-	return result;
 }
 
 static int __init ps3_register_graphics_devices(void)
@@ -479,6 +494,12 @@ static int __init ps3_register_graphics_devices(void)
 		struct ps3_system_bus_device dev;
 	} *p;
 
+	/*
+	 * ps3_system_bus_release_device() calls kfree(&p->dev).
+	 * dev must be at offset 0 so kfree() frees outer p.
+	 */
+	BUILD_BUG_ON(offsetof(struct layout, dev) != 0);
+
 	pr_debug(" -> %s:%d\n", __func__, __LINE__);
 
 	p = kzalloc_obj(struct layout);
@@ -495,16 +516,11 @@ static int __init ps3_register_graphics_devices(void)
 	if (result) {
 		pr_debug("%s:%d ps3_system_bus_device_register failed\n",
 			__func__, __LINE__);
-		goto fail_device_register;
+		return result;
 	}
 
 	pr_debug(" <- %s:%d\n", __func__, __LINE__);
 	return 0;
-
-fail_device_register:
-	kfree(p);
-	pr_debug(" <- %s:%d failed\n", __func__, __LINE__);
-	return result;
 }
 
 static int __init ps3_register_ramdisk_device(void)
@@ -514,6 +530,12 @@ static int __init ps3_register_ramdisk_device(void)
 		struct ps3_system_bus_device dev;
 	} *p;
 
+	/*
+	 * ps3_system_bus_release_device() calls kfree(&p->dev).
+	 * dev must be at offset 0 so kfree() frees outer p.
+	 */
+	BUILD_BUG_ON(offsetof(struct layout, dev) != 0);
+
 	pr_debug(" -> %s:%d\n", __func__, __LINE__);
 
 	p = kzalloc_obj(struct layout);
@@ -530,16 +552,11 @@ static int __init ps3_register_ramdisk_device(void)
 	if (result) {
 		pr_debug("%s:%d ps3_system_bus_device_register failed\n",
 			__func__, __LINE__);
-		goto fail_device_register;
+		return result;
 	}
 
 	pr_debug(" <- %s:%d\n", __func__, __LINE__);
 	return 0;
-
-fail_device_register:
-	kfree(p);
-	pr_debug(" <- %s:%d failed\n", __func__, __LINE__);
-	return result;
 }
 
 /**
diff --git a/arch/powerpc/platforms/ps3/system-bus.c b/arch/powerpc/platforms/ps3/system-bus.c
index 0537a678a32f..0918c74d3e19 100644
--- a/arch/powerpc/platforms/ps3/system-bus.c
+++ b/arch/powerpc/platforms/ps3/system-bus.c
@@ -774,6 +774,8 @@ int ps3_system_bus_device_register(struct ps3_system_bus_device *dev)
 	pr_debug("%s:%d add %s\n", __func__, __LINE__, dev_name(&dev->core));
 
 	result = device_register(&dev->core);
+	if (result)
+		put_device(&dev->core);
 	return result;
 }
 
-- 
2.55.0.699.gb54405d56f-goog

Re: [PATCH v2 3/3] powerpc/ps3: use put_device() on device_register() failure in ps3_system_bus_device_register

[Sourabh Jain]

On 13/08/26 15:24, Tarun Sahu wrote:
> When device_register() fails, calling put_device() ensures that the
> device reference count drops to 0, which invokes the release callback
> ps3_system_bus_release_device() to cleanly free the device and its
> associated driver core resources.

Yes, since the PS3 device has a release function, put_device() should be
used instead of manually freeing the memory, as described in 
device_register().

Changes look good to me. Feel free to add:
Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com>

>
> Signed-off-by: Tarun Sahu <tarunsahu@google.com>
> ---
>   arch/powerpc/platforms/ps3/device-init.c | 83 ++++++++++++++----------
>   arch/powerpc/platforms/ps3/system-bus.c  |  2 +
>   2 files changed, 52 insertions(+), 33 deletions(-)
>
> diff --git a/arch/powerpc/platforms/ps3/device-init.c b/arch/powerpc/platforms/ps3/device-init.c
> index 9109c218a060..8d0c77db1764 100644
> --- a/arch/powerpc/platforms/ps3/device-init.c
> +++ b/arch/powerpc/platforms/ps3/device-init.c
> @@ -90,14 +90,12 @@ static int __init ps3_register_lpm_devices(void)
>   	if (result) {
>   		pr_debug("%s:%d ps3_system_bus_device_register failed\n",
>   			__func__, __LINE__);
> -		goto fail_register;
> +		return result;
>   	}
>   
>   	pr_debug(" <- %s:%d\n", __func__, __LINE__);
>   	return 0;
>   
> -
> -fail_register:
>   fail_rights:
>   fail_read_repo:
>   	kfree(dev);
> @@ -121,6 +119,12 @@ static int __init ps3_setup_gelic_device(
>   		struct ps3_dma_region d_region;
>   	} *p;
>   
> +	/*
> +	 * ps3_system_bus_release_device() calls kfree(&p->dev).
> +	 * dev must be at offset 0 so kfree() frees outer p.
> +	 */
> +	BUILD_BUG_ON(offsetof(struct layout, dev) != 0);
> +
>   	pr_debug(" -> %s:%d\n", __func__, __LINE__);
>   
>   	BUG_ON(repo->bus_type != PS3_BUS_TYPE_SB);
> @@ -164,13 +168,12 @@ static int __init ps3_setup_gelic_device(
>   	if (result) {
>   		pr_debug("%s:%d ps3_system_bus_device_register failed\n",
>   			__func__, __LINE__);
> -		goto fail_device_register;
> +		return result;
>   	}
>   
>   	pr_debug(" <- %s:%d\n", __func__, __LINE__);
>   	return result;
>   
> -fail_device_register:
>   fail_dma_init:
>   fail_find_interrupt:
>   	kfree(p);
> @@ -192,6 +195,12 @@ static int __init ps3_setup_uhc_device(
>   	u64 bus_addr;
>   	u64 len;
>   
> +	/*
> +	 * ps3_system_bus_release_device() calls kfree(&p->dev).
> +	 * dev must be at offset 0 so kfree() frees outer p.
> +	 */
> +	BUILD_BUG_ON(offsetof(struct layout, dev) != 0);
> +
>   	pr_debug(" -> %s:%d\n", __func__, __LINE__);
>   
>   	BUG_ON(repo->bus_type != PS3_BUS_TYPE_SB);
> @@ -252,13 +261,12 @@ static int __init ps3_setup_uhc_device(
>   	if (result) {
>   		pr_debug("%s:%d ps3_system_bus_device_register failed\n",
>   			__func__, __LINE__);
> -		goto fail_device_register;
> +		return result;
>   	}
>   
>   	pr_debug(" <- %s:%d\n", __func__, __LINE__);
>   	return result;
>   
> -fail_device_register:
>   fail_mmio_init:
>   fail_dma_init:
>   fail_find_reg:
> @@ -291,6 +299,12 @@ static int __init ps3_setup_vuart_device(enum ps3_match_id match_id,
>   		struct ps3_system_bus_device dev;
>   	} *p;
>   
> +	/*
> +	 * ps3_system_bus_release_device() calls kfree(&p->dev).
> +	 * dev must be at offset 0 so kfree() frees outer p.
> +	 */
> +	BUILD_BUG_ON(offsetof(struct layout, dev) != 0);
> +
>   	pr_debug(" -> %s:%d: match_id %u, port %u\n", __func__, __LINE__,
>   		match_id, port_number);
>   
> @@ -308,15 +322,10 @@ static int __init ps3_setup_vuart_device(enum ps3_match_id match_id,
>   	if (result) {
>   		pr_debug("%s:%d ps3_system_bus_device_register failed\n",
>   			__func__, __LINE__);
> -		goto fail_device_register;
> +		return result;
>   	}
>   	pr_debug(" <- %s:%d\n", __func__, __LINE__);
>   	return 0;
> -
> -fail_device_register:
> -	kfree(p);
> -	pr_debug(" <- %s:%d fail\n", __func__, __LINE__);
> -	return result;
>   }
>   
>   static int ps3_setup_storage_dev(const struct ps3_repository_device *repo,
> @@ -327,6 +336,12 @@ static int ps3_setup_storage_dev(const struct ps3_repository_device *repo,
>   	u64 port, blk_size, num_blocks;
>   	unsigned int num_regions, i;
>   
> +	/*
> +	 * ps3_system_bus_release_device() calls kfree(&p->sbd).
> +	 * sbd must be at offset 0 so kfree() frees outer p.
> +	 */
> +	BUILD_BUG_ON(offsetof(struct ps3_storage_device, sbd) != 0);
> +
>   	pr_debug(" -> %s:%u: match_id %u\n", __func__, __LINE__, match_id);
>   
>   	result = ps3_repository_read_stor_dev_info(repo->bus_index,
> @@ -395,13 +410,12 @@ static int ps3_setup_storage_dev(const struct ps3_repository_device *repo,
>   	if (result) {
>   		pr_debug("%s:%u ps3_system_bus_device_register failed\n",
>   			 __func__, __LINE__);
> -		goto fail_device_register;
> +		return result;
>   	}
>   
>   	pr_debug(" <- %s:%u\n", __func__, __LINE__);
>   	return 0;
>   
> -fail_device_register:
>   fail_read_region:
>   fail_find_interrupt:
>   	kfree(p);
> @@ -445,6 +459,12 @@ static int __init ps3_register_sound_devices(void)
>   		struct ps3_mmio_region m_region;
>   	} *p;
>   
> +	/*
> +	 * ps3_system_bus_release_device() calls kfree(&p->dev).
> +	 * dev must be at offset 0 so kfree() frees outer p.
> +	 */
> +	BUILD_BUG_ON(offsetof(struct layout, dev) != 0);
> +
>   	pr_debug(" -> %s:%d\n", __func__, __LINE__);
>   
>   	p = kzalloc_obj(*p);
> @@ -461,15 +481,10 @@ static int __init ps3_register_sound_devices(void)
>   	if (result) {
>   		pr_debug("%s:%d ps3_system_bus_device_register failed\n",
>   			__func__, __LINE__);
> -		goto fail_device_register;
> +		return result;
>   	}
>   	pr_debug(" <- %s:%d\n", __func__, __LINE__);
>   	return 0;
> -
> -fail_device_register:
> -	kfree(p);
> -	pr_debug(" <- %s:%d failed\n", __func__, __LINE__);
> -	return result;
>   }
>   
>   static int __init ps3_register_graphics_devices(void)
> @@ -479,6 +494,12 @@ static int __init ps3_register_graphics_devices(void)
>   		struct ps3_system_bus_device dev;
>   	} *p;
>   
> +	/*
> +	 * ps3_system_bus_release_device() calls kfree(&p->dev).
> +	 * dev must be at offset 0 so kfree() frees outer p.
> +	 */
> +	BUILD_BUG_ON(offsetof(struct layout, dev) != 0);
> +
>   	pr_debug(" -> %s:%d\n", __func__, __LINE__);
>   
>   	p = kzalloc_obj(struct layout);
> @@ -495,16 +516,11 @@ static int __init ps3_register_graphics_devices(void)
>   	if (result) {
>   		pr_debug("%s:%d ps3_system_bus_device_register failed\n",
>   			__func__, __LINE__);
> -		goto fail_device_register;
> +		return result;
>   	}
>   
>   	pr_debug(" <- %s:%d\n", __func__, __LINE__);
>   	return 0;
> -
> -fail_device_register:
> -	kfree(p);
> -	pr_debug(" <- %s:%d failed\n", __func__, __LINE__);
> -	return result;
>   }
>   
>   static int __init ps3_register_ramdisk_device(void)
> @@ -514,6 +530,12 @@ static int __init ps3_register_ramdisk_device(void)
>   		struct ps3_system_bus_device dev;
>   	} *p;
>   
> +	/*
> +	 * ps3_system_bus_release_device() calls kfree(&p->dev).
> +	 * dev must be at offset 0 so kfree() frees outer p.
> +	 */
> +	BUILD_BUG_ON(offsetof(struct layout, dev) != 0);
> +
>   	pr_debug(" -> %s:%d\n", __func__, __LINE__);
>   
>   	p = kzalloc_obj(struct layout);
> @@ -530,16 +552,11 @@ static int __init ps3_register_ramdisk_device(void)
>   	if (result) {
>   		pr_debug("%s:%d ps3_system_bus_device_register failed\n",
>   			__func__, __LINE__);
> -		goto fail_device_register;
> +		return result;
>   	}
>   
>   	pr_debug(" <- %s:%d\n", __func__, __LINE__);
>   	return 0;
> -
> -fail_device_register:
> -	kfree(p);
> -	pr_debug(" <- %s:%d failed\n", __func__, __LINE__);
> -	return result;
>   }
>   
>   /**
> diff --git a/arch/powerpc/platforms/ps3/system-bus.c b/arch/powerpc/platforms/ps3/system-bus.c
> index 0537a678a32f..0918c74d3e19 100644
> --- a/arch/powerpc/platforms/ps3/system-bus.c
> +++ b/arch/powerpc/platforms/ps3/system-bus.c
> @@ -774,6 +774,8 @@ int ps3_system_bus_device_register(struct ps3_system_bus_device *dev)
>   	pr_debug("%s:%d add %s\n", __func__, __LINE__, dev_name(&dev->core));
>   
>   	result = device_register(&dev->core);
> +	if (result)
> +		put_device(&dev->core);
>   	return result;
>   }
>