From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E9C3F387588; Tue, 21 Jul 2026 20:51:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784667098; cv=none; b=IBvv3CmJCVWXOcE6Ay9JYxihssC17AQrSEm+85etStyju5dnO+z5BmJE3jGsPnIgDxtP6SXiZCLPq643r3Zy3E0IZlyJnAg9/ZO3ntLqAFCN86TdxNyPN5vdxGStVoiD7CXsxeOCdcxQpkdIZ+iOGYnkhE7JTU2ZLJF9IjIIbxw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784667098; c=relaxed/simple; bh=LSoQgQjEeU56ykCk5PPAfBiLsKoUHLWuwiKNt4RM4WM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MpaV4TP2a5lltNRxLT0ho4pj32IwkDKJi9PrpZnIAKqDheFQUFRlnAP1baWIXecL5+IWzu9C2sgNcxGXzCl30tpjyKpf9ss6+bXovWaIQIo2uBLXJa7BjIVbVMxnCjSVziculLNVm8AADHJr7zzuzZDiUBJdHZlSKjEOYPNDY4g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=EhJhlQLW; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="EhJhlQLW" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 15BDD1F000E9; Tue, 21 Jul 2026 20:51:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784667096; bh=aT63aGzaBBMjuDdxTgxmpKYybwz2c/9g1RVIV3oGlfk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=EhJhlQLWYFxFG1xf+sfeQlTn+7vmJQiVajDlgRwLMFHmHWUNj+EHmiQsnzVTUrrrd fjZZ0MabRt91/90AcqbNiOMlYcBM+zm/DXhGzEwrGa4GvkNC+tgEzsKtj44dXBzina cuod6xiG7rAytXtiQW7lEpTFYMVe1eF2GIpt/ykw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Guangshuo Li , Mikko Perttunen , Thierry Reding Subject: [PATCH 6.6 0933/1266] gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path Date: Tue, 21 Jul 2026 17:22:50 +0200 Message-ID: <20260721152502.713222274@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152441.786066624@linuxfoundation.org> References: <20260721152441.786066624@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Guangshuo Li commit e75717f9aec04355777be41070890c6a815c76df upstream. After device_initialize(), the embedded struct device in struct host1x_device should be released through the device core with put_device(). In host1x_device_add(), if host1x_device_parse_dt() fails, the current error path frees the object directly with kfree(device). That bypasses the normal device lifetime handling and leaks the reference held on the embedded struct device. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix this by using put_device() in the host1x_device_parse_dt() failure path. Fixes: f4c5cf88fbd50 ("gpu: host1x: Provide a proper struct bus_type") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Acked-by: Mikko Perttunen Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20260413141526.2961841-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/host1x/bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/host1x/bus.c +++ b/drivers/gpu/host1x/bus.c @@ -457,7 +457,7 @@ static int host1x_device_add(struct host err = host1x_device_parse_dt(device, driver); if (err < 0) { - kfree(device); + put_device(&device->dev); return err; }