[PATCH] platform/x86: intel_scu_wdt: fix reference leak on failed device registration

[PATCH] platform/x86: intel_scu_wdt: fix reference leak on failed device registration

[Guangshuo Li]

When platform_device_register() fails in register_mid_wdt(), the
embedded struct device in wdt_dev has already been initialized by
device_initialize(), but the failure path returns the error without
dropping the device reference for the current platform device:

  register_mid_wdt()
    -> platform_device_register(&wdt_dev)
       -> device_initialize(&wdt_dev.dev)
       -> setup_pdev_dma_masks(&wdt_dev)
       -> platform_device_add(&wdt_dev)

This leads to a reference leak when platform_device_register() fails.
Fix this by calling platform_device_put() before returning the error.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: 55627c70db6ad ("platform/x86: intel_scu_wdt: Drop SCU notification")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/platform/x86/intel_scu_wdt.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/intel_scu_wdt.c b/drivers/platform/x86/intel_scu_wdt.c
index 746d47d33406..bc120d57cadd 100644
--- a/drivers/platform/x86/intel_scu_wdt.c
+++ b/drivers/platform/x86/intel_scu_wdt.c
@@ -58,13 +58,18 @@ static const struct x86_cpu_id intel_mid_cpu_ids[] = {
 static int __init register_mid_wdt(void)
 {
 	const struct x86_cpu_id *id;
+	int ret;
 
 	id = x86_match_cpu(intel_mid_cpu_ids);
 	if (!id)
 		return -ENODEV;
 
 	wdt_dev.dev.platform_data = (struct intel_mid_wdt_pdata *)id->driver_data;
-	return platform_device_register(&wdt_dev);
+	ret = platform_device_register(&wdt_dev);
+	if (ret)
+		platform_device_put(&wdt_dev);
+
+	return ret;
 }
 arch_initcall(register_mid_wdt);
 
-- 
2.43.0

Re: [PATCH] platform/x86: intel_scu_wdt: fix reference leak on failed device registration

[Andy Shevchenko]

On Thu, Apr 16, 2026 at 02:00:42AM +0800, Guangshuo Li wrote:
> When platform_device_register() fails in register_mid_wdt(), the
> embedded struct device in wdt_dev has already been initialized by
> device_initialize(), but the failure path returns the error without
> dropping the device reference for the current platform device:
> 
>   register_mid_wdt()
>     -> platform_device_register(&wdt_dev)
>        -> device_initialize(&wdt_dev.dev)
>        -> setup_pdev_dma_masks(&wdt_dev)
>        -> platform_device_add(&wdt_dev)
> 
> This leads to a reference leak when platform_device_register() fails.
> Fix this by calling platform_device_put() before returning the error.
> 
> The issue was identified by a static analysis tool I developed and
> confirmed by manual review.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

-- 
With Best Regards,
Andy Shevchenko