Re: [PATCH v2 3/3] EDAC/versalnet: Fix device_register() error handling in init_one_mc()

Prasanna Kumar T S M
2026-04-09T09:46:08Z

On 01-04-2026 16:49, Prasanna Kumar T S M wrote:
> When device_register() fails, it must be followed by put_device()
> rather than kfree(), because device_register() calls
> device_initialize() which sets up the device refcount. The matching
> release function versal_edac_release() handles the actual kfree().
>
> To simplify error handling and avoid complex unwinding, split
> device_register() into device_initialize() and device_add().
> Initialize the device early so put_device() can be used in all
> error paths.
>
> Fixes: d5fe2fec6c40 ("EDAC: Add a driver for the AMD Versal NET DDR controller")
> Cc: stable@vger.kernel.org
> Signed-off-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com>
> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
> ---
> drivers/edac/versalnet_edac.c | 20 ++++++++++----------
> 1 file changed, 10 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/edac/versalnet_edac.c b/drivers/edac/versalnet_edac.c
> index 012c4f40994d..94580d3c3170 100644
> --- a/drivers/edac/versalnet_edac.c
> +++ b/drivers/edac/versalnet_edac.c
> @@ -780,7 +780,7 @@ static int init_one_mc(struct mc_priv *priv, struct platform_device *pdev, int i
> struct device *dev;
> enum dev_type dt;
> char name[MC_NAME_LEN];
> - int rc;
> + int rc = -ENOMEM;
>
> config = priv->adec[CONF + i * ADEC_NUM];
> num_chans = FIELD_GET(MC5_NUM_CHANS_MASK, config);
> @@ -812,23 +812,23 @@ static int init_one_mc(struct mc_priv *priv, struct platform_device *pdev, int i
> layers[1].size = num_chans;
> layers[1].is_virt_csrow = false;
>
> - rc = -ENOMEM;
> dev = kzalloc(sizeof(*dev), GFP_KERNEL);
> if (!dev)
> return rc;
>
> + sprintf(name, "versal-net-ddrmc5-edac-%d", i);
> +
> + dev->init_name = name;

Sashiko's review is valid
-------------------------
If edac_mc_alloc() fails below, we jump to err_dev_free, call
put_device(dev),
and return from init_one_mc(). Since kobject cleanup can be deferred
asynchronously (such as when CONFIG_DEBUG_KOBJECT_RELEASE is enabled), and
name is a local stack array, could this result in a use-after-free if
dev_name(dev) is accessed during cleanup?
Would it be safer to use dev_set_name(dev, "versal-net-ddrmc5-edac-%d", i)
instead of assigning dev->init_name directly?
-------------------------

This is a valid issue, I will fix it in the next iteration.

> + dev->release = versal_edac_release;
> + device_initialize(dev);
> +
> mci = edac_mc_alloc(i, ARRAY_SIZE(layers), layers, sizeof(struct mc_priv));
> if (!mci) {
> edac_printk(KERN_ERR, EDAC_MC, "Failed memory allocation for MC%d\n", i);
> goto err_dev_free;
> }
>
> - sprintf(name, "versal-net-ddrmc5-edac-%d", i);
> -
> - dev->init_name = name;
> - dev->release = versal_edac_release;
> -
> - rc = device_register(dev);
> + rc = device_add(dev);
> if (rc)
> goto err_mc_free;
>
> @@ -849,11 +849,11 @@ static int init_one_mc(struct mc_priv *priv, struct platform_device *pdev, int i
> return 0;
>
> err_unreg:
> - device_unregister(mci->pdev);
> + device_del(dev);
> err_mc_free:
> edac_mc_free(mci);
> err_dev_free:
> - kfree(dev);
> + put_device(dev);
>
> return rc;
> }