The memory allocated for cell.name using kmemdup() is not freed when
mfd_add_devices() fails. Fix that by checking return code and freeing.

Fixes: 8e00593557c3 ("mfd: Add mc13892 support to mc13xxx")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
v1->v2:
- Added the include of slab.h to ensure kfree is declared before use, to
  fix the compiler warning pointed out by kernel test robot.

 drivers/mfd/mc13xxx-core.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
index 920797b806ce..a6eebad16026 100644
--- a/drivers/mfd/mc13xxx-core.c
+++ b/drivers/mfd/mc13xxx-core.c
@@ -13,6 +13,7 @@
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/mfd/core.h>
+#include <linux/slab.h>
 
 #include "mc13xxx.h"
 
@@ -365,6 +366,7 @@ EXPORT_SYMBOL_GPL(mc13xxx_adc_do_conversion);
 static int mc13xxx_add_subdevice_pdata(struct mc13xxx *mc13xxx,
 		const char *format, void *pdata, size_t pdata_size)
 {
+	int ret;
 	char buf[30];
 	const char *name = mc13xxx_get_chipname(mc13xxx);
 
@@ -381,8 +383,11 @@ static int mc13xxx_add_subdevice_pdata(struct mc13xxx *mc13xxx,
 	if (!cell.name)
 		return -ENOMEM;
 
-	return mfd_add_devices(mc13xxx->dev, -1, &cell, 1, NULL, 0,
+	ret = mfd_add_devices(mc13xxx->dev, -1, &cell, 1, NULL, 0,
 			       regmap_irq_get_domain(mc13xxx->irq_data));
+	if (ret)
+		kfree(cell.name);
+	return ret;
 }
 
 static int mc13xxx_add_subdevice(struct mc13xxx *mc13xxx, const char *format)
-- 
2.43.0

On Thu, 27 Nov 2025, Abdun Nihaal wrote:

> The memory allocated for cell.name using kmemdup() is not freed when
> mfd_add_devices() fails. Fix that by checking return code and freeing.
> 
> Fixes: 8e00593557c3 ("mfd: Add mc13892 support to mc13xxx")
> Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
> ---
> v1->v2:
> - Added the include of slab.h to ensure kfree is declared before use, to
>   fix the compiler warning pointed out by kernel test robot.
> 
>  drivers/mfd/mc13xxx-core.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
> index 920797b806ce..a6eebad16026 100644
> --- a/drivers/mfd/mc13xxx-core.c
> +++ b/drivers/mfd/mc13xxx-core.c
> @@ -13,6 +13,7 @@
>  #include <linux/of_device.h>
>  #include <linux/platform_device.h>
>  #include <linux/mfd/core.h>
> +#include <linux/slab.h>
>  
>  #include "mc13xxx.h"
>  
> @@ -365,6 +366,7 @@ EXPORT_SYMBOL_GPL(mc13xxx_adc_do_conversion);
>  static int mc13xxx_add_subdevice_pdata(struct mc13xxx *mc13xxx,
>  		const char *format, void *pdata, size_t pdata_size)
>  {
> +	int ret;
>  	char buf[30];
>  	const char *name = mc13xxx_get_chipname(mc13xxx);
>  
> @@ -381,8 +383,11 @@ static int mc13xxx_add_subdevice_pdata(struct mc13xxx *mc13xxx,
>  	if (!cell.name)
>  		return -ENOMEM;
>  
> -	return mfd_add_devices(mc13xxx->dev, -1, &cell, 1, NULL, 0,
> +	ret = mfd_add_devices(mc13xxx->dev, -1, &cell, 1, NULL, 0,
>  			       regmap_irq_get_domain(mc13xxx->irq_data));
> +	if (ret)
> +		kfree(cell.name);
> +	return ret;

Why not simply use devm_kmemdup() instead?

-- 
Lee Jones [李琼斯]