If device_add() fails, call put_device() to drop the device
reference. And put_device() triggers fsl_mc_device_release()
which does the free. Thus just return after call put_device().

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/b767348e-d89c-416e-acea-1ebbff3bea20@stanley.mountain/
Signed-off-by: Su Hui <suhui@nfschina.com>
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
---
Changes in v2:
- fix a patch error. Thanks, Christophe.
- add specific changelog. Thanks, Dan.
---
 drivers/bus/fsl-mc/fsl-mc-bus.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
index 25845c04e562..f976c5a24151 100644
--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
@@ -896,7 +896,8 @@ int fsl_mc_device_add(struct fsl_mc_obj_desc *obj_desc,
 		dev_err(parent_dev,
 			"device_add() failed for device %s: %d\n",
 			dev_name(&mc_dev->dev), error);
-		goto error_cleanup_dev;
+		put_device(&mc_dev->dev);
+		return error;
 	}
 
 	dev_dbg(parent_dev, "added %s\n", dev_name(&mc_dev->dev));
-- 
2.25.1

On Wed, Dec 24, 2025 at 06:44:33PM +0800, Haoxiang Li wrote:
> If device_add() fails, call put_device() to drop the device
> reference. And put_device() triggers fsl_mc_device_release()
> which does the free. Thus just return after call put_device().
> 
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Closes: https://lore.kernel.org/all/b767348e-d89c-416e-acea-1ebbff3bea20@stanley.mountain/
> Signed-off-by: Su Hui <suhui@nfschina.com>
> Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
> ---
> Changes in v2:
> - fix a patch error. Thanks, Christophe.
> - add specific changelog. Thanks, Dan.
> ---
>  drivers/bus/fsl-mc/fsl-mc-bus.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
> index 25845c04e562..f976c5a24151 100644
> --- a/drivers/bus/fsl-mc/fsl-mc-bus.c
> +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
> @@ -896,7 +896,8 @@ int fsl_mc_device_add(struct fsl_mc_obj_desc *obj_desc,
>  		dev_err(parent_dev,
>  			"device_add() failed for device %s: %d\n",
>  			dev_name(&mc_dev->dev), error);
> -		goto error_cleanup_dev;
> +		put_device(&mc_dev->dev);
> +		return error;


Is there any reason why you didn't go with Christophe's suggestion from
https://lore.kernel.org/all/b7f7e968-a683-4e1e-8ccc-5dd19f0f15c5@kernel.org/ ?

It's perfectly valid to call put_device() even though device_add() was
not called, meaning from the other code paths.

Ioana

Hi, Ioana:

On Fri, 23 Jan 2026 13:10:46 +0200, Ioana Ciornei wrote:
> Is there any reason why you didn't go with Christophe's suggestion from
> https://lore.kernel.org/all/b7f7e968-a683-4e1e-8ccc-5dd19f0f15c5@kernel.org/ ?

> It's perfectly valid to call put_device() even though device_add() was
> not called, meaning from the other code paths.

Actually, I totally agree with that suggestion. However, I submit a same fix
several months ago and got a reply:
https://lore.kernel.org/all/2025052622-nautical-suitably-486c@gregkh/

I didn't figure out why. And if you agree with the Christophe's suggestion,
I will resubmit a patch v3.

Thanks,
Haoxiang Li

On Fri, Jan 23, 2026 at 07:35:29PM +0800, Haoxiang Li wrote:
> Hi, Ioana:
> 
> On Fri, 23 Jan 2026 13:10:46 +0200, Ioana Ciornei wrote:
> > Is there any reason why you didn't go with Christophe's suggestion from
> > https://lore.kernel.org/all/b7f7e968-a683-4e1e-8ccc-5dd19f0f15c5@kernel.org/ ?
> 
> > It's perfectly valid to call put_device() even though device_add() was
> > not called, meaning from the other code paths.
> 
> Actually, I totally agree with that suggestion. However, I submit a same fix
> several months ago and got a reply:
> https://lore.kernel.org/all/2025052622-nautical-suitably-486c@gregkh/
> 
> I didn't figure out why.

I think the problem was that the patch did not apply because commit
d694bf8a9acd ("bus: fsl-mc: fix double-free on mc_dev") was already
applied.

> And if you agree with the Christophe's suggestion,
> I will resubmit a patch v3.

Yes, I do agree with Christophe's suggestion. I even tested a bit that
both cases, with and without device_add() getting called, resources are
released properly if you use put_device().

Thanks!

> If device_add() fails, call put_device() to drop the device
> reference.

Can the word wrapping become nicer?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc3#n659


>            And put_device() triggers fsl_mc_device_release()
> which does the free. Thus just return after call put_device().

How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.19-rc3#n145

Regards,
Markus