[PATCH] mei: Fix error handling in mei_register

[PATCH] mei: Fix error handling in mei_register

[Ma Ke]

mei_register() fails to release the device reference in error paths
after device_initialize(). During normal device registration, the
reference is properly handled through mei_deregister() which calls
device_destroy(). However, in error handling paths (such as cdev_alloc
failure, cdev_add failure, etc.), missing put_device() calls cause
reference count leaks, preventing the device's release function
(mei_device_release) from being called and resulting in memory leaks
of mei_device.

Found by code review.

Cc: stable@vger.kernel.org
Fixes: 7704e6be4ed2 ("mei: hook mei_device on class device")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
---
 drivers/misc/mei/main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 86a73684a373..6f26d5160788 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -1307,6 +1307,7 @@ int mei_register(struct mei_device *dev, struct device *parent)
 err_del_cdev:
 	cdev_del(dev->cdev);
 err:
+	put_device(&dev->dev);
 	mei_minor_free(minor);
 	return ret;
 }
-- 
2.17.1

Re: [PATCH] mei: Fix error handling in mei_register

[Markus Elfring]

> mei_register() fails to release the device reference in error paths
…

Re: [PATCH] mei: Fix error handling in mei_register

[Markus Elfring]

> mei_register() fails to release the device reference in error paths
…

Would it be helpful to append parentheses also to the function name
in the summary phrase?

Regards,
Markus

Re: [PATCH] mei: Fix error handling in mei_register

[Greg Kroah-Hartman]

On Tue, Nov 04, 2025 at 04:30:08PM +0100, Markus Elfring wrote:
> > mei_register() fails to release the device reference in error paths
> …
> 
> Would it be helpful to append parentheses also to the function name
> in the summary phrase?
> 
> Regards,
> Markus

Hi,

This is the semi-friendly patch-bot of Greg Kroah-Hartman.

Markus, you seem to have sent a nonsensical or otherwise pointless
review comment to a patch submission on a Linux kernel developer mailing
list.  I strongly suggest that you not do this anymore.  Please do not
bother developers who are actively working to produce patches and
features with comments that, in the end, are a waste of time.

Patch submitter, please ignore Markus's suggestion; you do not need to
follow it at all.  The person/bot/AI that sent it is being ignored by
almost all Linux kernel maintainers for having a persistent pattern of
behavior of producing distracting and pointless commentary, and
inability to adapt to feedback.  Please feel free to also ignore emails
from them.

thanks,

greg k-h's patch email bot

RE: [PATCH] mei: Fix error handling in mei_register

[Usyskin, Alexander]

> Subject: [PATCH] mei: Fix error handling in mei_register
> 
> mei_register() fails to release the device reference in error paths
> after device_initialize(). During normal device registration, the
> reference is properly handled through mei_deregister() which calls
> device_destroy(). However, in error handling paths (such as cdev_alloc
> failure, cdev_add failure, etc.), missing put_device() calls cause
> reference count leaks, preventing the device's release function
> (mei_device_release) from being called and resulting in memory leaks
> of mei_device.
> 
> Found by code review.
> 

Nice catch.
Acked-by: Alexander Usyskin <alexander.usyskin@intel.com>

> Cc: stable@vger.kernel.org
> Fixes: 7704e6be4ed2 ("mei: hook mei_device on class device")
> Signed-off-by: Ma Ke <make24@iscas.ac.cn>
> ---
>  drivers/misc/mei/main.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
> index 86a73684a373..6f26d5160788 100644
> --- a/drivers/misc/mei/main.c
> +++ b/drivers/misc/mei/main.c
> @@ -1307,6 +1307,7 @@ int mei_register(struct mei_device *dev, struct
> device *parent)
>  err_del_cdev:
>  	cdev_del(dev->cdev);
>  err:
> +	put_device(&dev->dev);
>  	mei_minor_free(minor);
>  	return ret;
>  }
> --
> 2.17.1