[PATCH] floppy: fix reference leak on platform_device_register() failure

[PATCH] floppy: fix reference leak on platform_device_register() failure

[Guangshuo Li]

When platform_device_register() fails in do_floppy_init(), the embedded
struct device in floppy_device[drive] has already been initialized by
device_initialize(), but the failure path jumps to out_remove_drives
without dropping the device reference for the current drive.

Previously registered floppy devices are cleaned up in out_remove_drives,
but the device for the drive that fails registration is not, leading to
a reference leak.

The issue was identified by a static analysis tool I developed and
confirmed by manual review. Fix this by calling put_device() for the
current floppy device before jumping to the common cleanup path.

Fixes: 94fd0db7bfb4a ("[PATCH] Floppy: Add cmos attribute to floppy driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/block/floppy.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index c28786e0fe1c..d9afe495d5c2 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4724,8 +4724,10 @@ static int __init do_floppy_init(void)
 		floppy_device[drive].dev.groups = floppy_dev_groups;
 
 		err = platform_device_register(&floppy_device[drive]);
-		if (err)
+		if (err) {
+			put_device(&floppy_device[drive].dev);
 			goto out_remove_drives;
+		}
 
 		registered[drive] = true;
 
-- 
2.43.0

Re: [PATCH] floppy: fix reference leak on platform_device_register() failure

[Denis Efremov (Oracle)]

Hello,

Thank you for the patch,

On 13/04/2026 19:31, Guangshuo Li wrote:
> When platform_device_register() fails in do_floppy_init(), the embedded
> struct device in floppy_device[drive] has already been initialized by
> device_initialize(), but the failure path jumps to out_remove_drives
> without dropping the device reference for the current drive.
> 
> Previously registered floppy devices are cleaned up in out_remove_drives,
> but the device for the drive that fails registration is not, leading to
> a reference leak.
> 
> The issue was identified by a static analysis tool I developed and
> confirmed by manual review. Fix this by calling put_device() for the
> current floppy device before jumping to the common cleanup path.
> 
> Fixes: 94fd0db7bfb4a ("[PATCH] Floppy: Add cmos attribute to floppy driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/block/floppy.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
> index c28786e0fe1c..d9afe495d5c2 100644
> --- a/drivers/block/floppy.c
> +++ b/drivers/block/floppy.c
> @@ -4724,8 +4724,10 @@ static int __init do_floppy_init(void)
>  		floppy_device[drive].dev.groups = floppy_dev_groups;
>  
>  		err = platform_device_register(&floppy_device[drive]);
> -		if (err)
> +		if (err) {
> +			put_device(&floppy_device[drive].dev);

1. Let's use platform_device_put()

>  			goto out_remove_drives;
> +		}
>  
>  		registered[drive] = true;
>  

                err = device_add_disk(&floppy_device[drive].dev,
                                      disks[drive][0], NULL);
                if (err)
                        goto out_remove_drives;

2. We also need to fix this case.

platform_device_unregister()
registered[drive] = false;
goto ...

Thanks,
Denis

Re: [PATCH] floppy: fix reference leak on platform_device_register() failure

[Guangshuo Li]

Hi Denis,

Thank you for the review.

On Wed, 15 Apr 2026 at 21:00, Denis Efremov (Oracle) <efremov@linux.com> wrote:
>
> 1. Let's use platform_device_put()
>
> >                       goto out_remove_drives;
> > +             }
> >
> >               registered[drive] = true;
> >

My understanding is:

For the platform_device_register() failure case, we should use
platform_device_put() instead of put_device(), so the failure path
would look like:

err = platform_device_register(&floppy_device[drive]);
if (err) {
        platform_device_put(&floppy_device[drive]);
        goto out_remove_drives;
}
registered[drive] = true;

>                 err = device_add_disk(&floppy_device[drive].dev,
>                                       disks[drive][0], NULL);
>                 if (err)
>                         goto out_remove_drives;
>
> 2. We also need to fix this case.
>
> platform_device_unregister()
> registered[drive] = false;
> goto ...
>
> Thanks,
> Denis
We also need to handle the device_add_disk() failure case for the
current drive, since out_remove_drives only cleans up previously
registered drives. So this path should explicitly unregister the
current platform device before jumping to the common cleanup path, for
example:

err = device_add_disk(&floppy_device[drive].dev, disks[drive][0], NULL);
if (err) {
        platform_device_unregister(&floppy_device[drive]);
        registered[drive] = false;
        goto out_remove_drives;
}


Is my understanding correct? If so, I will prepare and send a v2
following this pattern.

Thanks,
Guangshuo

Re: [PATCH] floppy: fix reference leak on platform_device_register() failure

[Denis Efremov (Oracle)]

On 15/04/2026 17:54, Guangshuo Li wrote:
> Hi Denis,
> 
> Thank you for the review.
> 
> On Wed, 15 Apr 2026 at 21:00, Denis Efremov (Oracle) <efremov@linux.com> wrote:
>>
>> 1. Let's use platform_device_put()
>>
>>>                       goto out_remove_drives;
>>> +             }
>>>
>>>               registered[drive] = true;
>>>
> 
> My understanding is:
> 
> For the platform_device_register() failure case, we should use
> platform_device_put() instead of put_device(), so the failure path
> would look like:
> 
> err = platform_device_register(&floppy_device[drive]);
> if (err) {
>         platform_device_put(&floppy_device[drive]);
>         goto out_remove_drives;
> }
> registered[drive] = true;

Yes, correct.

> 
>>                 err = device_add_disk(&floppy_device[drive].dev,
>>                                       disks[drive][0], NULL);
>>                 if (err)
>>                         goto out_remove_drives;
>>
>> 2. We also need to fix this case.
>>
>> platform_device_unregister()
>> registered[drive] = false;
>> goto ...
>>
>> Thanks,
>> Denis
> We also need to handle the device_add_disk() failure case for the
> current drive, since out_remove_drives only cleans up previously
> registered drives. So this path should explicitly unregister the
> current platform device before jumping to the common cleanup path, for
> example:
> 
> err = device_add_disk(&floppy_device[drive].dev, disks[drive][0], NULL);
> if (err) {
>         platform_device_unregister(&floppy_device[drive]);
>         registered[drive] = false;
>         goto out_remove_drives;
> }
> 
> 
> Is my understanding correct? If so, I will prepare and send a v2
> following this pattern.

Yes, correct. Please, send v2.

> 
> Thanks,
> Guangshuo