From nobody Mon Jun 15 20:34:36 2026 Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com [209.85.215.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 793D63D8116 for ; Mon, 13 Apr 2026 14:13:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776089622; cv=none; b=Iz/UknqamoK0CgnGu5WU6bR6lH6ANTqTWG4LHee6kyVXw/KK7zQgYa4XS8NiS/kLtWVG+Ue4P1bgnNpOpWNqtLqrsuV6qJTVpmtfSGaEK+8Y7sYxBTkUk+VVZU3dLke05SgkRZ9O9w7EE2arnEDjLg/dT47onUg1Bq0Vs3Maw4w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776089622; c=relaxed/simple; bh=5S3YAVKId+04a0qvuN0YFuWomUi+TppqBBWCt03upfc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=chagq4c4xEQJ4CUpI+ibY0+TvyoXruw8TotloQAI9j8BB2F4vlj5ywLZZeCN3mHkWPf4KcBdTqfw4UOvirBr1IURh2TOq2ggaHu0qPgcFd99mQppDC6c5xexQst+b9M5ol6oux2nve9EFdMOH2hNXIpNanwNFunVe/MzfRseaRo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=GBN90tUb; arc=none smtp.client-ip=209.85.215.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="GBN90tUb" Received: by mail-pg1-f169.google.com with SMTP id 41be03b00d2f7-c742d4df00cso1627117a12.1 for ; Mon, 13 Apr 2026 07:13:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776089621; x=1776694421; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Q+qqSEWuusa4ngNGb7Rrw9FBrzRc6uTBdINaFH/HdeE=; b=GBN90tUbaSJDVDCerN87/RzUxkuYqEzHz5DWs2XPwWhyMX1QPasgpng/hxAeyFCpey ngimKXmf/VkhzBu0j3SgtUr6PopDfksyUcIsSpyaD3Mw/jQ+1zCp6PBUS/yFsB4OHqwX Dvf3lnSRahlVJGHIQ11rQRVAJ1KzPKhBFQB76EmP6iU3r3hG08DIvy/pALCXW+0jYFp9 xacD/ZsA34uVvaCi4p32JifjuoNeBvBaK1mZM1vjCv72zsUrPkUiyFuA3lTVhZ3d65Ar hnn9M9TbL5SmTNtL4zg2dDSY1T1hq/F3rIDZ/Dv9pAPNZeq1ndXHoIUXF45P4HwC3OZf pYaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776089621; x=1776694421; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Q+qqSEWuusa4ngNGb7Rrw9FBrzRc6uTBdINaFH/HdeE=; b=oJYDxBg7RdNISqIATDmaSAufghkZHpYAsd7tHa+5ABLqiBXuXQ7yyy6JZqKOceq6hj GEPtV03ljnn4DJb1GRt3OBVXqiyLFVAGEfoOEx8KW0ckz7Q2Kd1o2EwMq6gj9xBddgwe actCcZybfRhpHlbJmc/rkXtEwTpkh3ptJRdEumL3rIUeacarnMy73Qk9Zt8GiUwjI+3x +XqtVxVzmbdNKF38vE8z3GRfTfab5P+/HDye60r5+3qRQc/Flcvc3B5Zqi6Mu4hh1/Cv cZMiS/X7KbELsWMX2FOE5BOfvyTESl1DTVIZBGI0IpC6Ms6KdJiGiO0GEL3uzIi3RA4A jokA== X-Forwarded-Encrypted: i=1; AFNElJ8T5uO3WIVPzvggOrC0E1kKUlyDMeO9p99btmp1nkZqlNM5GGI3JqVnHjP8W3WfVesxmu9tcAwfwWMyUv4=@vger.kernel.org X-Gm-Message-State: AOJu0YxKMLpcr5RVtLVaMnDcXcyaAZ6iBLBu2xA+RYVQesxcP/K9/gYp k4a1R4Gd/ZXvMkg/hvjegxEvfPdsAZUz2DLpS1ryMH70nLjjcQV89QPN X-Gm-Gg: AeBDietYxnhsxOcUz4lx5WiAjXVKQC7VKvKTkVXmWHPUNfH/Qzo8Cj07+ldKJv0fqPo 7vJY4FT2xEjemMjZC6LKwl9A8ZfEz+dklTv8RRK9Gq2vB0/vu/xjaOg0Im4ldVr0Yu1YXVgqd2E mFXL4EVOgX56bnrGSDN95HdjsV9a7s22FGDIeQzv/8gW94oByiBCfmf0QaIFMFkc1FLyCVN6z9U D2135dlk5uIih2xvUl4k+dD1ESToJgqSdkoJDvoWCOqTbNS5Qht5F0oYnjBjs5RlbuAVCg5lqy2 P7M+FMcoolyVsUabiDD364i+33Jau9/x+nF60bY7XqptfD8u4dok0klwEA1mwPZBMua5SmoqRs5 0bXaoS3jMm2cTQUY8CjCNEzhhpg8ryacv9YLSzvk0m/n3S1vcwlJTBGGzX7g7Z0P7dOQXDufnDI OyqvW0Rjk9dtsWdHXn5A6+CM0Lxvivq0nkfcLHo1D6Og== X-Received: by 2002:a17:902:e78e:b0:2b0:91e6:bc18 with SMTP id d9443c01a7336-2b2d5d0e8b6mr126999785ad.14.1776089620819; Mon, 13 Apr 2026 07:13:40 -0700 (PDT) Received: from lgs.. ([2409:893d:1188:142d:6c67:74e8:5200:1f39]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b2d4dd5cfasm144226695ad.18.2026.04.13.07.13.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Apr 2026 07:13:40 -0700 (PDT) From: Guangshuo Li To: Thierry Reding , Mikko Perttunen , David Airlie , Simona Vetter , Guangshuo Li , Vamsee Vardhan Thummala , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-tegra@vger.kernel.org Cc: stable@vger.kernel.org Subject: [PATCH v2] gpu: host1x: Fix device reference leak in device_add() error path Date: Mon, 13 Apr 2026 22:13:28 +0800 Message-ID: <20260413141328.2954939-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" After device_initialize(), the embedded struct device in struct host1x_device should be released through the device core with put_device(). In host1x_device_add(), the empty-subdevice path calls device_add(&device->dev), but if that fails it only logs the error and continues without dropping the device reference. That leaks the reference held on the embedded struct device. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix this by removing the device from host1x->devices and calling put_device() when device_add() fails. Fixes: fab823d82ee50 ("gpu: host1x: Allow loading tegra-drm without enabled= engines") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- v2: - note that the issue was identified by my static analysis tool - and confirmed by manual review drivers/firmware/edd.c | 2 +- drivers/gpu/host1x/bus.c | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/firmware/edd.c b/drivers/firmware/edd.c index 55dec4eb2c00..82b326ce83ce 100644 --- a/drivers/firmware/edd.c +++ b/drivers/firmware/edd.c @@ -748,7 +748,7 @@ edd_init(void) =20 rc =3D edd_device_register(edev, i); if (rc) { - kfree(edev); + kobject_put(&edev->kobj); goto out; } edd_devices[i] =3D edev; diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c index 723a80895cd4..63fe037c3b65 100644 --- a/drivers/gpu/host1x/bus.c +++ b/drivers/gpu/host1x/bus.c @@ -477,8 +477,12 @@ static int host1x_device_add(struct host1x *host1x, */ if (list_empty(&device->subdevs)) { err =3D device_add(&device->dev); - if (err < 0) + if (err < 0) { dev_err(&device->dev, "failed to add device: %d\n", err); + list_del(&device->list); + put_device(&device->dev); + return err; + } else device->registered =3D true; } --=20 2.43.0