Re: [PATCH 3/5] mtd: maps: physmap: fix reference leak on failed device registration

Re: [PATCH 3/5] mtd: maps: physmap: fix reference leak on failed device registration

[Miquel Raynal]

On 04/05/2026 at 13:08:45 +03, Vastargazing <vebohr@gmail.com> wrote:

> When platform_device_register() fails in physmap_init(), the embedded
> struct device has already been initialized by device_initialize() inside
> platform_device_register(). The error path unregisters the driver but
> returns without dropping the device reference:
>
>   physmap_init()
>     -> platform_device_register(&physmap_flash)
>        -> device_initialize(&physmap_flash.dev)   /* kref = 1 */
>        -> platform_device_add(&physmap_flash)     /* fails */
>     <- platform_driver_unregister() called, but kref still 1
>
> Per platform_device_register() kernel-doc:
>
>   NOTE: _Never_ directly free @pdev after calling this function, even if
>   it returned an error! Always use platform_device_put() to give up the
>   reference initialised in this function instead.
>
> Fix this by calling platform_device_put() before unregistering the driver.
>
> Fixes: 73566edf9b91 ("[MTD] Convert physmap to platform driver")
> Cc: stable@vger.kernel.org
> Assisted-by: GitHub Copilot (Claude Sonnet 4.5)
> Signed-off-by: Vastargazing <vebohr@gmail.com>

Somehow b4 applied another patch from that series, I'm not sure why. I
just dropped it. Please resend this patch alone.

Also, your SoB line seems to be incorrect, we need a proper name, please
have a loot at the DCO.

Thanks,
Miquèl

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH 1/5] perf/arm_pmu_acpi: fix reference leak in arm_pmu_acpi_probe error path

[Valery Borovsky]

Yeah, you're right, my bad. The `arm_pmu_acpi.c` patch is definitely broken.

Since `spe_dev` and `trbe_dev` are statically allocated, they don't have a
`.dev.release` callback. If we hit `platform_device_put()` here, the refcount
drops to zero and triggers `device_release()`, which is going to scream about
the missing release function. At best, we get a messy WARN; at worst, it'll
panic the kernel if someone's running with `panic_on_warn`.

The kernel-doc note about `platform_device_put()` is really meant for dynamic
allocations where the release path actually frees memory. For static setups
like this, the original code is actually the right way to go.

Please drop patches 1/5 through 4/5 from the v1 series—they all suffer from
the same logic error. Patch 5/5 (mfd: sm501) is the only clean one, so I've
re-sent that as a standalone v2.

Sorry for the noise.

Valery Borovsky

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH 3/5] mtd: maps: physmap-core: fix reference leak on failed device registration

[Valery Borovsky]

Hi Miquel,

Thanks for the review. I need to withdraw this patch as well, for the same
reason as the rest of the series.

`physmap_flash` is a static `platform_device` without a `.dev.release`
callback. Using `platform_device_put()` triggers a `WARN` in
`device_release()` when the kref hits zero, which is a dealbreaker for
systems with `panic_on_warn=1`.

The kernel-doc NOTE refers to dynamically allocated devices; for static
ones, the original code is actually correct.

I've already sent a withdrawal notice for the whole series (1/5-4/5) to
the cover letter thread. Sorry for the noise.

Best,
Valery Borovsky

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/