[bug report] rpmsg: char: Implement eptdev based on anonymous inode

[Dan Carpenter <dan.carpenter@linaro.org>]

Hello Dawei Li,

Commit 2410558f5f11 ("rpmsg: char: Implement eptdev based on
anonymous inode") from Oct 15, 2025 (linux-next), leads to the
following Smatch static checker warning:

	drivers/rpmsg/rpmsg_char.c:548 rpmsg_anonymous_eptdev_create()
	error: dereferencing freed memory 'eptdev' (line 546)

drivers/rpmsg/rpmsg_char.c
    538         /* Anonymous inode only supports these file flags */
    539         if (flags & ~(O_ACCMODE | O_NONBLOCK | O_CLOEXEC))
    540                 return -EINVAL;
    541 
    542         eptdev = rpmsg_eptdev_alloc(rpdev, parent, false);
    543         if (IS_ERR(eptdev))
    544                 return PTR_ERR(eptdev);
    545 
    546         ret =  rpmsg_eptdev_add(eptdev, chinfo, false);
    547         if (ret) {
--> 548                 dev_err(&eptdev->dev, "failed to add %s\n", eptdev->chinfo.name);
                                 ^^^^^^                             ^^^^^^
The rpmsg_eptdev_add() function frees "eptdev" on error.

    549                 return ret;
    550         }
    551 
    552         fd = anon_inode_getfd("rpmsg-eptdev", &rpmsg_anonymous_eptdev_fops, eptdev, flags);
    553         if (fd < 0) {
    554                 put_device(&eptdev->dev);
    555                 return fd;
    556         }
    557 
    558         mutex_lock(&eptdev->ept_lock);
    559         ret = __rpmsg_eptdev_open(eptdev);

Should we free eptdev if __rpmsg_eptdev_open() fails?

    560         mutex_unlock(&eptdev->ept_lock);
    561 
    562         if (!ret)
    563                 *pfd = fd;
    564 
    565         return ret;
    566 }

regards,
dan carpenter