* [PATCH v2] mfd: sm501: fix reference leak on failed device registration [not found] <6b4a9f5ae8a316b6f07f72f2fe3f0b8fc5f18dff.1777889235.git.vebohr@gmail.com> @ 2026-05-04 12:48 ` Valery Borovsky 2026-05-04 13:52 ` Miquel Raynal 2026-05-06 15:40 ` [PATCH v3] " Valery Borovsky 0 siblings, 2 replies; 7+ messages in thread From: Valery Borovsky @ 2026-05-04 12:48 UTC (permalink / raw) To: Lee Jones Cc: Ben Dooks, Vincent Sanders, Andrew Morton, linux-kernel, Valery Borovsky, stable When platform_device_register() fails in sm501_register_device(), the platform device allocated by sm501_create_subdev() has its struct device initialized by device_initialize() inside platform_device_register(). The error path logs the error but returns without dropping the device reference, leaking the memory allocated by sm501_create_subdev(): sm501_register_device() -> platform_device_register(pdev) -> device_initialize(&pdev->dev) /* kref = 1 */ -> platform_device_add(pdev) /* fails */ <- dev_err() called, kref still 1, sm501_device_release never called The device's release callback (sm501_device_release) calls kfree() on the containing sm501_device structure. Without platform_device_put(), this memory is never freed. Per platform_device_register() kernel-doc: NOTE: _Never_ directly free @pdev after calling this function, even if it returned an error! Always use platform_device_put() to give up the reference initialised in this function instead. Fix this by calling platform_device_put() in the error branch, which triggers sm501_device_release() and frees the allocated memory. Fixes: b6d6454fdb66 ("[PATCH] mfd: SM501 core driver") Cc: stable@vger.kernel.org Signed-off-by: Valery Borovsky <vebohr@gmail.com> --- drivers/mfd/sm501.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c index 0ee6d8940e69..8276456b142f 100644 --- a/drivers/mfd/sm501.c +++ b/drivers/mfd/sm501.c @@ -704,9 +704,11 @@ static int sm501_register_device(struct sm501_devdata *sm, if (ret >= 0) { dev_dbg(sm->dev, "registered %s\n", pdev->name); list_add_tail(&smdev->list, &sm->devices); - } else + } else { dev_err(sm->dev, "error registering %s (%d)\n", pdev->name, ret); + platform_device_put(pdev); + } return ret; } -- 2.51.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH v2] mfd: sm501: fix reference leak on failed device registration 2026-05-04 12:48 ` [PATCH v2] mfd: sm501: fix reference leak on failed device registration Valery Borovsky @ 2026-05-04 13:52 ` Miquel Raynal 2026-05-05 15:00 ` Lee Jones 2026-05-06 15:40 ` [PATCH v3] " Valery Borovsky 1 sibling, 1 reply; 7+ messages in thread From: Miquel Raynal @ 2026-05-04 13:52 UTC (permalink / raw) To: Lee Jones, Valery Borovsky Cc: Ben Dooks, Vincent Sanders, Andrew Morton, linux-kernel, stable On Mon, 04 May 2026 15:48:41 +0300, Valery Borovsky wrote: > When platform_device_register() fails in sm501_register_device(), the > platform device allocated by sm501_create_subdev() has its struct device > initialized by device_initialize() inside platform_device_register(). The > error path logs the error but returns without dropping the device reference, > leaking the memory allocated by sm501_create_subdev(): > > sm501_register_device() > -> platform_device_register(pdev) > -> device_initialize(&pdev->dev) /* kref = 1 */ > -> platform_device_add(pdev) /* fails */ > <- dev_err() called, kref still 1, sm501_device_release never called > > [...] Applied to mtd/next, thanks! [1/1] mfd: sm501: fix reference leak on failed device registration commit: faa9bba3fe2f37e7dcb26d4501d890fbfd7df160 Patche(s) should be available on mtd/linux.git and will be part of the next PR (provided that no robot complains by then). Kind regards, Miquèl ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2] mfd: sm501: fix reference leak on failed device registration 2026-05-04 13:52 ` Miquel Raynal @ 2026-05-05 15:00 ` Lee Jones 2026-05-05 15:12 ` Miquel Raynal 0 siblings, 1 reply; 7+ messages in thread From: Lee Jones @ 2026-05-05 15:00 UTC (permalink / raw) To: Miquel Raynal Cc: Valery Borovsky, Ben Dooks, Vincent Sanders, Andrew Morton, linux-kernel, stable On Mon, 04 May 2026, Miquel Raynal wrote: > On Mon, 04 May 2026 15:48:41 +0300, Valery Borovsky wrote: > > When platform_device_register() fails in sm501_register_device(), the > > platform device allocated by sm501_create_subdev() has its struct device > > initialized by device_initialize() inside platform_device_register(). The > > error path logs the error but returns without dropping the device reference, > > leaking the memory allocated by sm501_create_subdev(): > > > > sm501_register_device() > > -> platform_device_register(pdev) > > -> device_initialize(&pdev->dev) /* kref = 1 */ > > -> platform_device_add(pdev) /* fails */ > > <- dev_err() called, kref still 1, sm501_device_release never called > > > > [...] > > Applied to mtd/next, thanks! I think you misread the subject line. > [1/1] mfd: sm501: fix reference leak on failed device registration > commit: faa9bba3fe2f37e7dcb26d4501d890fbfd7df160 > > Patche(s) should be available on mtd/linux.git and will be > part of the next PR (provided that no robot complains by then). Please remove this from your tree. It should be handled via M[F]D. Thanks. -- Lee Jones ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2] mfd: sm501: fix reference leak on failed device registration 2026-05-05 15:00 ` Lee Jones @ 2026-05-05 15:12 ` Miquel Raynal 0 siblings, 0 replies; 7+ messages in thread From: Miquel Raynal @ 2026-05-05 15:12 UTC (permalink / raw) To: Lee Jones Cc: Valery Borovsky, Ben Dooks, Vincent Sanders, Andrew Morton, linux-kernel, stable Hi Lee, On 05/05/2026 at 16:00:13 +01, Lee Jones <lee@kernel.org> wrote: > On Mon, 04 May 2026, Miquel Raynal wrote: > >> On Mon, 04 May 2026 15:48:41 +0300, Valery Borovsky wrote: >> > When platform_device_register() fails in sm501_register_device(), the >> > platform device allocated by sm501_create_subdev() has its struct device >> > initialized by device_initialize() inside platform_device_register(). The >> > error path logs the error but returns without dropping the device reference, >> > leaking the memory allocated by sm501_create_subdev(): >> > >> > sm501_register_device() >> > -> platform_device_register(pdev) >> > -> device_initialize(&pdev->dev) /* kref = 1 */ >> > -> platform_device_add(pdev) /* fails */ >> > <- dev_err() called, kref still 1, sm501_device_release never called >> > >> > [...] >> >> Applied to mtd/next, thanks! > > I think you misread the subject line. > >> [1/1] mfd: sm501: fix reference leak on failed device registration >> commit: faa9bba3fe2f37e7dcb26d4501d890fbfd7df160 >> >> Patche(s) should be available on mtd/linux.git and will be >> part of the next PR (provided that no robot complains by then). > > Please remove this from your tree. It should be handled via M[F]D. Yes, it took a bit of time for me to receive my own answer so I replied to the original patch immediately stating that I dropped it. For some reason b4 applied this patch, whereas I was applying another m*t*d patch from apparently the same series (?). Both the contribution and b4 behaviour was strange. Sorry for the noise. Thanks, Miquèl ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH v3] mfd: sm501: fix reference leak on failed device registration 2026-05-04 12:48 ` [PATCH v2] mfd: sm501: fix reference leak on failed device registration Valery Borovsky 2026-05-04 13:52 ` Miquel Raynal @ 2026-05-06 15:40 ` Valery Borovsky 2026-05-14 14:54 ` Lee Jones 2026-05-14 16:26 ` Valery Borovsky 1 sibling, 2 replies; 7+ messages in thread From: Valery Borovsky @ 2026-05-06 15:40 UTC (permalink / raw) To: Lee Jones; +Cc: Andrew Morton, linux-kernel, Valery Borovsky, stable When platform_device_register() fails in sm501_register_device(), the platform device allocated by sm501_create_subdev() has its struct device initialized by device_initialize() inside platform_device_register(). The error path logs the error but returns without dropping the device reference, leaking the memory allocated by sm501_create_subdev(): sm501_register_device() -> platform_device_register(pdev) -> device_initialize(&pdev->dev) /* kref = 1 */ -> platform_device_add(pdev) /* fails */ <- dev_err() called, kref still 1, sm501_device_release never called The device's release callback (sm501_device_release) calls kfree() on the containing sm501_device structure. Without platform_device_put(), this memory is never freed. Per platform_device_register() kernel-doc: NOTE: _Never_ directly free @pdev after calling this function, even if it returned an error! Always use platform_device_put() to give up the reference initialised in this function instead. Fix this by calling platform_device_put() in the error branch, which triggers sm501_device_release() and frees the allocated memory. Fixes: b6d6454fdb66 ("[PATCH] mfd: SM501 core driver") Cc: stable@vger.kernel.org Signed-off-by: Valery Borovsky <vebohr@gmail.com> --- drivers/mfd/sm501.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c index 0ee6d8940e69..8276456b142f 100644 --- a/drivers/mfd/sm501.c +++ b/drivers/mfd/sm501.c @@ -704,9 +704,11 @@ static int sm501_register_device(struct sm501_devdata *sm, if (ret >= 0) { dev_dbg(sm->dev, "registered %s\n", pdev->name); list_add_tail(&smdev->list, &sm->devices); - } else + } else { dev_err(sm->dev, "error registering %s (%d)\n", pdev->name, ret); + platform_device_put(pdev); + } return ret; } -- 2.51.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH v3] mfd: sm501: fix reference leak on failed device registration 2026-05-06 15:40 ` [PATCH v3] " Valery Borovsky @ 2026-05-14 14:54 ` Lee Jones 2026-05-14 16:26 ` Valery Borovsky 1 sibling, 0 replies; 7+ messages in thread From: Lee Jones @ 2026-05-14 14:54 UTC (permalink / raw) To: Valery Borovsky; +Cc: Andrew Morton, linux-kernel, stable On Wed, 06 May 2026, Valery Borovsky wrote: > When platform_device_register() fails in sm501_register_device(), the > platform device allocated by sm501_create_subdev() has its struct device > initialized by device_initialize() inside platform_device_register(). The > error path logs the error but returns without dropping the device reference, > leaking the memory allocated by sm501_create_subdev(): > > sm501_register_device() > -> platform_device_register(pdev) > -> device_initialize(&pdev->dev) /* kref = 1 */ > -> platform_device_add(pdev) /* fails */ > <- dev_err() called, kref still 1, sm501_device_release never called > > The device's release callback (sm501_device_release) calls kfree() on the > containing sm501_device structure. Without platform_device_put(), this > memory is never freed. > > Per platform_device_register() kernel-doc: > > NOTE: _Never_ directly free @pdev after calling this function, even if > it returned an error! Always use platform_device_put() to give up the > reference initialised in this function instead. > > Fix this by calling platform_device_put() in the error branch, which > triggers sm501_device_release() and frees the allocated memory. > > Fixes: b6d6454fdb66 ("[PATCH] mfd: SM501 core driver") > Cc: stable@vger.kernel.org > Signed-off-by: Valery Borovsky <vebohr@gmail.com> > --- > drivers/mfd/sm501.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) I don't see a message from me acknowledging this, but it is applied to my tree. -- Lee Jones ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v3] mfd: sm501: fix reference leak on failed device registration 2026-05-06 15:40 ` [PATCH v3] " Valery Borovsky 2026-05-14 14:54 ` Lee Jones @ 2026-05-14 16:26 ` Valery Borovsky 1 sibling, 0 replies; 7+ messages in thread From: Valery Borovsky @ 2026-05-14 16:26 UTC (permalink / raw) To: Lee Jones; +Cc: Andrew Morton, linux-kernel, stable, Valery Borovsky Hi Lee, Great, thanks for picking it up — confirmed on my end. For context: an earlier version of this patch ended up briefly in mtd/next by accident (Miquel applied it to the wrong tree, then dropped it), so I appreciate you taking it directly into MFD. Best, Valery ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-05-14 16:27 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <6b4a9f5ae8a316b6f07f72f2fe3f0b8fc5f18dff.1777889235.git.vebohr@gmail.com>
2026-05-04 12:48 ` [PATCH v2] mfd: sm501: fix reference leak on failed device registration Valery Borovsky
2026-05-04 13:52 ` Miquel Raynal
2026-05-05 15:00 ` Lee Jones
2026-05-05 15:12 ` Miquel Raynal
2026-05-06 15:40 ` [PATCH v3] " Valery Borovsky
2026-05-14 14:54 ` Lee Jones
2026-05-14 16:26 ` Valery Borovsky
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox