Re: [PATCH v3] mfd: sm501: fix reference leak on failed device registration

[Lee Jones <lee@kernel.org>]

On Wed, 06 May 2026, Valery Borovsky wrote:

> When platform_device_register() fails in sm501_register_device(), the
> platform device allocated by sm501_create_subdev() has its struct device
> initialized by device_initialize() inside platform_device_register(). The
> error path logs the error but returns without dropping the device reference,
> leaking the memory allocated by sm501_create_subdev():
> 
>   sm501_register_device()
>     -> platform_device_register(pdev)
>        -> device_initialize(&pdev->dev)   /* kref = 1 */
>        -> platform_device_add(pdev)       /* fails */
>     <- dev_err() called, kref still 1, sm501_device_release never called
> 
> The device's release callback (sm501_device_release) calls kfree() on the
> containing sm501_device structure. Without platform_device_put(), this
> memory is never freed.
> 
> Per platform_device_register() kernel-doc:
> 
>   NOTE: _Never_ directly free @pdev after calling this function, even if
>   it returned an error! Always use platform_device_put() to give up the
>   reference initialised in this function instead.
> 
> Fix this by calling platform_device_put() in the error branch, which
> triggers sm501_device_release() and frees the allocated memory.
> 
> Fixes: b6d6454fdb66 ("[PATCH] mfd: SM501 core driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Valery Borovsky <vebohr@gmail.com>
> ---
>  drivers/mfd/sm501.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

I don't see a message from me acknowledging this, but it is applied to my tree.

-- 
Lee Jones