[PATCH] media: vim2m: fix reference leak on failed device registration

[PATCH] media: vim2m: fix reference leak on failed device registration

[Guangshuo Li]

When platform_device_register() fails in vim2m_init(), the embedded
struct device in vim2m_pdev has already been initialized by
device_initialize(), but the failure path returns the error without
dropping the device reference for the current platform device:

  vim2m_init()
    -> platform_device_register(&vim2m_pdev)
       -> device_initialize(&vim2m_pdev.dev)
       -> setup_pdev_dma_masks(&vim2m_pdev)
       -> platform_device_add(&vim2m_pdev)

This leads to a reference leak when platform_device_register() fails.
Fix this by calling platform_device_put() before returning the error.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: 1f923a42033ad ("[media] mem2mem_testdev: rename to vim2m")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/media/test-drivers/vim2m.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/test-drivers/vim2m.c b/drivers/media/test-drivers/vim2m.c
index bb2dd11eef0e..80dc7edcbb5e 100644
--- a/drivers/media/test-drivers/vim2m.c
+++ b/drivers/media/test-drivers/vim2m.c
@@ -1601,8 +1601,10 @@ static int __init vim2m_init(void)
 	int ret;
 
 	ret = platform_device_register(&vim2m_pdev);
-	if (ret)
+	if (ret) {
+		platform_device_put(&vim2m_pdev);
 		return ret;
+	}
 
 	ret = platform_driver_register(&vim2m_pdrv);
 	if (ret)
-- 
2.43.0

Re: [PATCH] media: vim2m: fix reference leak on failed device registration

[Laurent Pinchart]

On Wed, Apr 15, 2026 at 11:14:49PM +0800, Guangshuo Li wrote:
> When platform_device_register() fails in vim2m_init(), the embedded
> struct device in vim2m_pdev has already been initialized by
> device_initialize(), but the failure path returns the error without
> dropping the device reference for the current platform device:
> 
>   vim2m_init()
>     -> platform_device_register(&vim2m_pdev)
>        -> device_initialize(&vim2m_pdev.dev)
>        -> setup_pdev_dma_masks(&vim2m_pdev)
>        -> platform_device_add(&vim2m_pdev)
> 
> This leads to a reference leak when platform_device_register() fails.
> Fix this by calling platform_device_put() before returning the error.

Functions that don't clean after themselves on failure are not a very
good practice. It indeed seems that platform_device_register() will
leave a dangling kref. Most callers don't seem to be aware of this
though, even platform_add_devices() doesn't call platform_device_put() !
This makes me think that this patch just works around the problem. A
better solution is needed. Have you investigated if
platform_device_register() can drop the reference on failure ? What
problems would that cause ?

> The issue was identified by a static analysis tool I developed and
> confirmed by manual review.
> 
> Fixes: 1f923a42033ad ("[media] mem2mem_testdev: rename to vim2m")

Quote unlikely.

> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/media/test-drivers/vim2m.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/test-drivers/vim2m.c b/drivers/media/test-drivers/vim2m.c
> index bb2dd11eef0e..80dc7edcbb5e 100644
> --- a/drivers/media/test-drivers/vim2m.c
> +++ b/drivers/media/test-drivers/vim2m.c
> @@ -1601,8 +1601,10 @@ static int __init vim2m_init(void)
>  	int ret;
>  
>  	ret = platform_device_register(&vim2m_pdev);
> -	if (ret)
> +	if (ret) {
> +		platform_device_put(&vim2m_pdev);
>  		return ret;
> +	}
>  
>  	ret = platform_driver_register(&vim2m_pdrv);
>  	if (ret)

-- 
Regards,

Laurent Pinchart

Re: [PATCH] media: vim2m: fix reference leak on failed device registration

[Guangshuo Li]

Hi Laurent,

Thanks for the review.

On Thu, 16 Apr 2026 at 17:49, Laurent Pinchart
<laurent.pinchart@ideasonboard.com> wrote:
>

> Functions that don't clean after themselves on failure are not a very
> good practice. It indeed seems that platform_device_register() will
> leave a dangling kref. Most callers don't seem to be aware of this
> though, even platform_add_devices() doesn't call platform_device_put() !
> This makes me think that this patch just works around the problem. A
> better solution is needed. Have you investigated if
> platform_device_register() can drop the reference on failure ? What
> problems would that cause ?
>
> > The issue was identified by a static analysis tool I developed and
> > confirmed by manual review.
> >
> > Fixes: 1f923a42033ad ("[media] mem2mem_testdev: rename to vim2m")
>
> Quote unlikely.
>


You are right, this may be a workaround rather than the best fix if the
underlying issue is really in the platform_device_register() failure
semantics.

There is also discussion along the same lines in another patch caused by
the same API pattern:
https://patchew.org/linux/20260415174159.3625777-1-lgs201920130244@gmail.com/

We are discussing there whether there is a better fix at the API/core
level instead of handling individual callers one by one.

Thanks,
Guangshuo

Re: media: vim2m: fix reference leak on failed device registration

[Guangshuo Li]

Hi,

On Thu, 16 Apr 2026 at 00:10, Patchwork Integration
<patchwork@media-ci.org> wrote:
>
> Dear Guangshuo Li:
>
> Thanks for your patches! Unfortunately the Media CI robot detected some
> issues:
>
>
>
> Please fix your series, and upload a new version. If you have a patchwork
> account, do not forget to mark the current series as Superseded.
>
> For more details, check the full report at:
> https://linux-media.pages.freedesktop.org/-/users/patchwork/-/jobs/97571257/artifacts/report.htm .
>
>
>
> Best regards, and Happy Hacking!
> Media CI robot on behalf of the linux-media community.
>
> ---
> Check the latest rules for contributing your patches at:
> https://docs.kernel.org/driver-api/media/maintainer-entry-profile.html
>
> If you believe that the CI is wrong, kindly open an issue at
> https://gitlab.freedesktop.org/linux-media/media-ci/-/issues or reply-all
> to this message.
>

I checked the logs for the failed build-basic and static jobs.

Both jobs failed during the process of pulling Docker images due to CI
runner infrastructure issues:

build-basic: Failed with unexpected EOF while pulling the image
registry.freedesktop.org/linux-media/media-ci/build:latest.

static: Failed with ssh tunnel: read tcp ... connection reset by peer
while pulling the image
registry.freedesktop.org/linux-media/media-ci/static:latest.

These errors seem related to infrastructure/network problems rather
than an issue with the patch itself.

Could you please confirm whether this failure can be ignored or if the
jobs can be retried?

Thanks,
Guangshuo Li