From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-lf1-f45.google.com (mail-lf1-f45.google.com [209.85.167.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0859549553D for ; Wed, 6 May 2026 15:40:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778082050; cv=none; b=GcRI8PGQuQKhvebYUfhpVeWXGdM2fch2E6MkVRIIxzV6/kVIlRYOarstk5ZcxFF82hzRyGi8KFXtuCJKiKcaAZObYwTUUYq9AGN2dnrpQxvKfYXctu/Yk2EQsbmmynwSD47vC3ov+JHqPDDnhJ86vOsMqW7Eu9Ty87IQunw2feQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778082050; c=relaxed/simple; bh=lH1s4f1DsUeMWlf3k4JQdvGtPacKmGPSl5TfO1+bXNk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jhdPuauRJW3rgPcyXhTgXEHMfXgRltgqYi6wDoVMPGacc2M7kobjs4Fp1tvw0DjwvVy+3+8UxSqXDF59ssQ3k6WECNj0ou9kja+5/BTapTGb25BXi90W9x9CZ0fDk+AGHlMfIWR7K7tHBJRk2k9sJfRyqXbweqy0GnYJnYjp8jM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BDKkztDg; arc=none smtp.client-ip=209.85.167.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BDKkztDg" Received: by mail-lf1-f45.google.com with SMTP id 2adb3069b0e04-5a3af1b7549so8508514e87.1 for ; Wed, 06 May 2026 08:40:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778082043; x=1778686843; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=6Hp5CCZAjAcFJLhnHM/r6dRzm24SM3LtlL2s2xjPAQQ=; b=BDKkztDgOIKqwqIzIxm+RXYycD+wW6HSWH0e1t6o7OgpsY47Bq4GHBsGC7vMvtR8aS 468h5JYudYUtGKMXznxTb15XSqRq8Oqs48odgCdM2jEgKMuB8jowaYNh+XTLBCxfNJRi PayC0jiznQxlsQCmH2RIFThnGjfR10kudipQ4SkBbWThtTq9HS8/nrdmA04j8nFGlHr8 e/WxzMEpS+oy4Upr9Nud5o9FCKMM6AkYNfeVtg0fOeY6YdOkxKNO8wqt5SrQlnS92wwP baqmjlsraYAJJb5DbP8RvlU7pzoOqqrcgLlYVcSDegv/lZpEXKNf7FNZwEJOP0vIBF1q RRhg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778082043; x=1778686843; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=6Hp5CCZAjAcFJLhnHM/r6dRzm24SM3LtlL2s2xjPAQQ=; b=PNeiV5AorNNOmc5nd4wL7DZeTgGVgyKrp1aEfhXuBWOMEJg6cfHGFWc8s7iTX1x0X+ X0NEbcQrYxnmDKksVSrxZr0QCsJZfGx2oCqakgqHmEGNJIImK49aKcYBLnAxa4cE0lX8 lji3lkcDQAPAS6quCFa8X48+00J+RguxcyqupcO7BOeuGssBqZzJyaC5tW2b3YU1biM6 8c3zblNoCxxgPqjBGSUuhljzgsStWt/dtsoQj+2is/Uo2Uf0qA/Ie1anO3DzqB73LWuf DR9iGThM35Z/pemXM30CegieZKBj5ZHfTisEzBGeC+K52/medGSYIN2nKGYJ8Y0TrguA RQxA== X-Forwarded-Encrypted: i=1; AFNElJ+EujlKS2aU8SKaRW3/f5GI8kBz8mCxrmtQgldiyJUIq7lNmbG9rE4NhIlPBYIY3h713fz7tNVrtGR3vbc=@vger.kernel.org X-Gm-Message-State: AOJu0YyIpw41CnCEmdE7kBecVJeYC6nOjnIr1RmNQRynKHriIDzq817/ xmBZi12iE2tgoFwVGoitnDAvkzSrergOMSIi4DbyAcgM/kGhOmnEuQUr X-Gm-Gg: AeBDietbr+iQ1sC3TtNczZHODjYXiBau0FeGXUliM59gGCXgvbrMmJi6cVNTB0UpuwA 4pKcs1bYftrtQo0FEQu6iwd1qdWdg9gKZiXBlvPVI+Ku1ze7UYEzcp1XoGuLF59f/OcHZ1nGBvl gWik7R6agWoyCVog+te3ZaDn0OulP+OEYUKZ0FWiu5FJkNdq9UiGWasBASttBFJw3kVMybAOSrY 8y7vcB95Q0uO3ExD4258v+jPPCim8a3UFdVhZkoLOF8PebR3G9qfr/jnSGUgfSOLPe2XFWTcXgh xpJllD3fpuIBLEy5XMo4XdTVJtiZ8XAtlqdAe1LV7obFzbyaYjbPvARQSCM3RVuPO/sgT6XlG5t bjEQpUuEeDHNZCdKsXnzEdIJOGcF3gAO4FDxwM/Yg8auoseh8PLdvDttVJC0AUskLHbWklFcGkV eJQHK43MS2ID89mngrTbKQWwcSSXznPEduzmN7W58ymNkAjfPvzYxK8Ul8Q2dNMgMr5TClSAk= X-Received: by 2002:a05:6512:12ce:b0:5a8:5277:12c with SMTP id 2adb3069b0e04-5a887ae3e8dmr1492467e87.17.1778082042812; Wed, 06 May 2026 08:40:42 -0700 (PDT) Received: from va-HP-Pavilion-Desktop-595-p0xxx.mshome.net ([193.0.150.248]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5a888d59084sm643334e87.2.2026.05.06.08.40.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 06 May 2026 08:40:42 -0700 (PDT) From: Valery Borovsky To: Lee Jones Cc: Andrew Morton , linux-kernel@vger.kernel.org, Valery Borovsky , stable@vger.kernel.org Subject: [PATCH v3] mfd: sm501: fix reference leak on failed device registration Date: Wed, 6 May 2026 18:40:40 +0300 Message-ID: <20260506154040.672860-1-vebohr@gmail.com> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260504124841.443496-1-vebohr@gmail.com> References: <20260504124841.443496-1-vebohr@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit When platform_device_register() fails in sm501_register_device(), the platform device allocated by sm501_create_subdev() has its struct device initialized by device_initialize() inside platform_device_register(). The error path logs the error but returns without dropping the device reference, leaking the memory allocated by sm501_create_subdev(): sm501_register_device() -> platform_device_register(pdev) -> device_initialize(&pdev->dev) /* kref = 1 */ -> platform_device_add(pdev) /* fails */ <- dev_err() called, kref still 1, sm501_device_release never called The device's release callback (sm501_device_release) calls kfree() on the containing sm501_device structure. Without platform_device_put(), this memory is never freed. Per platform_device_register() kernel-doc: NOTE: _Never_ directly free @pdev after calling this function, even if it returned an error! Always use platform_device_put() to give up the reference initialised in this function instead. Fix this by calling platform_device_put() in the error branch, which triggers sm501_device_release() and frees the allocated memory. Fixes: b6d6454fdb66 ("[PATCH] mfd: SM501 core driver") Cc: stable@vger.kernel.org Signed-off-by: Valery Borovsky --- drivers/mfd/sm501.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c index 0ee6d8940e69..8276456b142f 100644 --- a/drivers/mfd/sm501.c +++ b/drivers/mfd/sm501.c @@ -704,9 +704,11 @@ static int sm501_register_device(struct sm501_devdata *sm, if (ret >= 0) { dev_dbg(sm->dev, "registered %s\n", pdev->name); list_add_tail(&smdev->list, &sm->devices); - } else + } else { dev_err(sm->dev, "error registering %s (%d)\n", pdev->name, ret); + platform_device_put(pdev); + } return ret; } -- 2.51.0