Re: [PATCH v2 3/3] EDAC/versalnet: Fix device_register() error handling in init_one_mc()

[Prasanna Kumar T S M <ptsm@linux.microsoft.com>]

On 01-04-2026 16:49, Prasanna Kumar T S M wrote:
> When device_register() fails, it must be followed by put_device()
> rather than kfree(), because device_register() calls
> device_initialize() which sets up the device refcount. The matching
> release function versal_edac_release() handles the actual kfree().
> 
> To simplify error handling and avoid complex unwinding, split
> device_register() into device_initialize() and device_add().
> Initialize the device early so put_device() can be used in all
> error paths.
> 
> Fixes: d5fe2fec6c40 ("EDAC: Add a driver for the AMD Versal NET DDR controller")
> Cc: stable@vger.kernel.org
> Signed-off-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com>
> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
> ---
>   drivers/edac/versalnet_edac.c | 20 ++++++++++----------
>   1 file changed, 10 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/edac/versalnet_edac.c b/drivers/edac/versalnet_edac.c
> index 012c4f40994d..94580d3c3170 100644
> --- a/drivers/edac/versalnet_edac.c
> +++ b/drivers/edac/versalnet_edac.c
> @@ -780,7 +780,7 @@ static int init_one_mc(struct mc_priv *priv, struct platform_device *pdev, int i
>   	struct device *dev;
>   	enum dev_type dt;
>   	char name[MC_NAME_LEN];
> -	int rc;
> +	int rc = -ENOMEM;
>   
>   	config = priv->adec[CONF + i * ADEC_NUM];
>   	num_chans = FIELD_GET(MC5_NUM_CHANS_MASK, config);
> @@ -812,23 +812,23 @@ static int init_one_mc(struct mc_priv *priv, struct platform_device *pdev, int i
>   	layers[1].size = num_chans;
>   	layers[1].is_virt_csrow = false;
>   
> -	rc = -ENOMEM;
>   	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
>   	if (!dev)
>   		return rc;
>   
> +	sprintf(name, "versal-net-ddrmc5-edac-%d", i);
> +
> +	dev->init_name = name;

Sashiko's review is valid
-------------------------
If edac_mc_alloc() fails below, we jump to err_dev_free, call 
put_device(dev),
and return from init_one_mc(). Since kobject cleanup can be deferred
asynchronously (such as when CONFIG_DEBUG_KOBJECT_RELEASE is enabled), and
name is a local stack array, could this result in a use-after-free if
dev_name(dev) is accessed during cleanup?
Would it be safer to use dev_set_name(dev, "versal-net-ddrmc5-edac-%d", i)
instead of assigning dev->init_name directly?
-------------------------

This is a valid issue, I will fix it in the next iteration.

> +	dev->release = versal_edac_release;
> +	device_initialize(dev);
> +
>   	mci = edac_mc_alloc(i, ARRAY_SIZE(layers), layers, sizeof(struct mc_priv));
>   	if (!mci) {
>   		edac_printk(KERN_ERR, EDAC_MC, "Failed memory allocation for MC%d\n", i);
>   		goto err_dev_free;
>   	}
>   
> -	sprintf(name, "versal-net-ddrmc5-edac-%d", i);
> -
> -	dev->init_name = name;
> -	dev->release = versal_edac_release;
> -
> -	rc = device_register(dev);
> +	rc = device_add(dev);
>   	if (rc)
>   		goto err_mc_free;
>   
> @@ -849,11 +849,11 @@ static int init_one_mc(struct mc_priv *priv, struct platform_device *pdev, int i
>   	return 0;
>   
>   err_unreg:
> -	device_unregister(mci->pdev);
> +	device_del(dev);
>   err_mc_free:
>   	edac_mc_free(mci);
>   err_dev_free:
> -	kfree(dev);
> +	put_device(dev);
>   
>   	return rc;
>   }