[PATCH] ALSA: pcmtest: fix reference leak on failed device registration

[PATCH] ALSA: pcmtest: fix reference leak on failed device registration

[Guangshuo Li]

When platform_device_register() fails in mod_init(), the embedded struct
device in pcmtst_pdev has already been initialized by
device_initialize(), but the failure path returns the error without
dropping the device reference for the current platform device:

  mod_init()
    -> platform_device_register(&pcmtst_pdev)
       -> device_initialize(&pcmtst_pdev.dev)
       -> setup_pdev_dma_masks(&pcmtst_pdev)
       -> platform_device_add(&pcmtst_pdev)

This leads to a reference leak when platform_device_register() fails.
Fix this by calling platform_device_put() before returning the error.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: 315a3d57c64c5 ("ALSA: Implement the new Virtual PCM Test Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 sound/drivers/pcmtest.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/drivers/pcmtest.c b/sound/drivers/pcmtest.c
index 768bb698adfb..20ceb9082fa9 100644
--- a/sound/drivers/pcmtest.c
+++ b/sound/drivers/pcmtest.c
@@ -756,8 +756,10 @@ static int __init mod_init(void)
 	if (err)
 		return err;
 	err = platform_device_register(&pcmtst_pdev);
-	if (err)
+	if (err) {
+		platform_device_put(&pcmtst_pdev);
 		return err;
+	}
 	err = platform_driver_register(&pcmtst_pdrv);
 	if (err)
 		platform_device_unregister(&pcmtst_pdev);
-- 
2.43.0

Re: [PATCH] ALSA: pcmtest: fix reference leak on failed device registration

[Takashi Iwai]

On Wed, 15 Apr 2026 21:31:38 +0200,
Guangshuo Li wrote:
> 
> When platform_device_register() fails in mod_init(), the embedded struct
> device in pcmtst_pdev has already been initialized by
> device_initialize(), but the failure path returns the error without
> dropping the device reference for the current platform device:
> 
>   mod_init()
>     -> platform_device_register(&pcmtst_pdev)
>        -> device_initialize(&pcmtst_pdev.dev)
>        -> setup_pdev_dma_masks(&pcmtst_pdev)
>        -> platform_device_add(&pcmtst_pdev)
> 
> This leads to a reference leak when platform_device_register() fails.
> Fix this by calling platform_device_put() before returning the error.
> 
> The issue was identified by a static analysis tool I developed and
> confirmed by manual review.
> 
> Fixes: 315a3d57c64c5 ("ALSA: Implement the new Virtual PCM Test Driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

Thanks, applied now.


Takashi

Re: [PATCH] ALSA: pcmtest: fix reference leak on failed device registration

[Takashi Iwai]

On Fri, 17 Apr 2026 09:57:20 +0200,
Takashi Iwai wrote:
> 
> On Wed, 15 Apr 2026 21:31:38 +0200,
> Guangshuo Li wrote:
> > 
> > When platform_device_register() fails in mod_init(), the embedded struct
> > device in pcmtst_pdev has already been initialized by
> > device_initialize(), but the failure path returns the error without
> > dropping the device reference for the current platform device:
> > 
> >   mod_init()
> >     -> platform_device_register(&pcmtst_pdev)
> >        -> device_initialize(&pcmtst_pdev.dev)
> >        -> setup_pdev_dma_masks(&pcmtst_pdev)
> >        -> platform_device_add(&pcmtst_pdev)
> > 
> > This leads to a reference leak when platform_device_register() fails.
> > Fix this by calling platform_device_put() before returning the error.
> > 
> > The issue was identified by a static analysis tool I developed and
> > confirmed by manual review.
> > 
> > Fixes: 315a3d57c64c5 ("ALSA: Implement the new Virtual PCM Test Driver")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> 
> Thanks, applied now.

... and now I looked through the whole tree, and noticed that the
majority of callers of platform_device_register() don't care the error
cases without calling platform_device_put().  There are over a hundred
callers of platform_device_register() while only 5 or so are doing the
proper cleanup at the error.

Judging from the numbers above, it might be better to change the
behavior of platform_device_register() itself to call *_put() at the
error case internally.  Or, if we keep the current behavior, at least
we should properly document it.

Greg, Rafael, Danilo, what do you think?


thanks,

Takashi

Re: [PATCH] ALSA: pcmtest: fix reference leak on failed device registration

[Guangshuo Li]

Hi Takashi,

Thanks for reviewing.

On Fri, 17 Apr 2026 at 18:52, Takashi Iwai <tiwai@suse.de> wrote:
>
>
> ... and now I looked through the whole tree, and noticed that the
> majority of callers of platform_device_register() don't care the error
> cases without calling platform_device_put().  There are over a hundred
> callers of platform_device_register() while only 5 or so are doing the
> proper cleanup at the error.
>
> Judging from the numbers above, it might be better to change the
> behavior of platform_device_register() itself to call *_put() at the
> error case internally.  Or, if we keep the current behavior, at least
> we should properly document it.
>
> Greg, Rafael, Danilo, what do you think?
>
>
> thanks,
>
> Takashi

I agree with your observation. Given that many callers of
platform_device_register() do not handle the error path with a
matching platform_device_put(), this does seem more like an issue
related to the core/API behavior, or at least something that should be
documented more clearly.

Also, the underlying issue here appears to be related to the
platform_device_register() core/API behavior. We are currently
discussing in another similar case whether the better fix, if any,
should be made in the core/API code rather than in individual callers:

https://patchew.org/linux/20260415174159.3625777-1-lgs201920130244@gmail.com/

Once that discussion reaches a conclusion, we will revisit this and
make the appropriate fix if needed.

Thanks,
Guangshuo