From nobody Mon Jun 15 20:34:37 2026 Received: from mail-pf1-f169.google.com (mail-pf1-f169.google.com [209.85.210.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6E0193D75C5 for ; Mon, 13 Apr 2026 14:16:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776089764; cv=none; b=M5oGYs9h65Q8aCOz9bQreEaqeRGTcmj0x3QAjVNyggBe35/Rb8rLhJtLPMmXnUPP0c2CBK1gxn+HFxT1ZYpLH3rwr1OUOvwn0cw0wm6FQ0K8DNvAgoSBl2pkZWMDJ+YU9iZG8Kgwajdq0zfEGuoQYW06HksLRO4urMwgYjU9fqc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776089764; c=relaxed/simple; bh=joQClY02gPxW9Rgcbp7cpGeoX2QQLsorYSTJB70FVCY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=eAP4XfxvzAednXr4RPm06n9zIe0ihVVkZ+ZH/nDdVPWvsi4H5nNzGvD4bQfUdCwPcWmV1Vf/679QZAc3sKKHlIoflyJYSuV/2pOun/YSkeesNC+hV4eyCTgMBBWohw9l4U4zLcxKpo9gYzxNKJk3pIpDIGUwYUnsKwAopfgRr4s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=fpE4uFcS; arc=none smtp.client-ip=209.85.210.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="fpE4uFcS" Received: by mail-pf1-f169.google.com with SMTP id d2e1a72fcca58-82f0fc82c76so1171085b3a.0 for ; Mon, 13 Apr 2026 07:16:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776089763; x=1776694563; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=e0zbRRSwXZ7Pwh3Wo3GiTsNe9+S5y60LaaG4gtv9gLI=; b=fpE4uFcSQ93uZqwt9purUfTlAbpVDNmiEnXLWomjMdpAtKiwmdEnPGKGIySxODYzkT 1Z4t77ZKgTQzVXtnHRltKGDIvI+tN5bF3ZKaVbFxAhUAk1P+xJB7wQDC8vUdpf4gGufQ q8V/kVCO3U5VuDXh2r1Z57iGrJfNH+NvBTCRbbdOJeq9uScF8oF+q4DrqRbNLY0bBtXt I56XHKbj8lnJqPCTbYaYngSDu3sWW1U8IPmgdcFI299x/F9I0qSCEALcVUEHBgmHfKeX smJZ2xAyA19R16/wf7zkyPjJn4L/Z4ohuN863Z88SGkLY5z7JRspXc3Xjz7O9iWdQZeq ma7Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776089763; x=1776694563; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=e0zbRRSwXZ7Pwh3Wo3GiTsNe9+S5y60LaaG4gtv9gLI=; b=NQkTw2WL8ks0eCjYlCcgao5tDSFeXQEItNtsrZ8iHIaeeWw2zDO1pAwVXE2OFg8hDd nJc72t2yu0LwOUg28xHRA5rDLuExW74oJZytOpgB2xdVSFb6NxWeQlZ5scikAimB3p2a gTUVQY4PikOB5jUwNGZFDtuXsPrmm/9MQ5UMkQv58/ezBhbZVic/dPfOfEXVVY4ZzTlf XeR4m+TpiV0gVqqi43DzD7SSuHhWwMG4dERdOkqnRkIv6cFuXGoLEZEVHXgwFUlXn4Lj +cHI9bd17ajy4esx+F6AFwpNQWA2aTktGDWB0ZbxYSVJl1O/UVIhbHOYICx8K0NuvG28 ElWA== X-Forwarded-Encrypted: i=1; AFNElJ+fFAqPTCkPD3nfexSntx9Ac8IgQj/fXmVZKRMxbVP7ZaxBT3L7YnSNmmoly/XcRGhlyuTUkqQO6M8Kk00=@vger.kernel.org X-Gm-Message-State: AOJu0Yx0jfsIEmRxRLUbWx3xKftO41Hw9VMNjp0z48Wn+in8aNabZw6R 9PFg8RuYl/iYjToV4/oTooc41F1q5yD1ucCu+0nZ6zjsPqiQ1FTE1edJ X-Gm-Gg: AeBDiet/PfVIg7KtpGvX7pwSk5Nh2Q4tsPXRXniL8B0/RTsdMg+flt4IqSUbTViJNgM ndX4Ccn8UNPmgzRssznTnu7SYjcDrrdE9qmNZAy3IGP0WDLiCB+lDNl9jX4Tq8CQgiEDZ9IijfR 2YhVMInv7bMRsbmfy4OeLFn4cfl3AMYLkv68G1k4OH1F6tDWvafwXC7n1JfE0N6EHjlIih7RoFU dzWCfKA6ELSNmicP22X/wUNFLNBYTQhtFGiNOwsM35jK5xs6M4V31Kd/xET8TfbvTKhZeAHUDtu dN137TWOZYY+jkpBAEIdot+kaVOYY3YWoyBqCN6lXgtOT0hWwjWeWj0q/BZ6+SgtavE6O66ayk8 oesdZtKCxrz39vSr5/rrJheYizwYFgGV4mb61gNKunfe1lgVtXrBbNjeKGekWkcGP8o87PfsiVc hXPiD69wAnCUVwdeJWx4BdYnO+Kmhbvnc= X-Received: by 2002:a05:6a00:170c:b0:82c:ddbb:7db3 with SMTP id d2e1a72fcca58-82f0c21d396mr13302565b3a.25.1776089762689; Mon, 13 Apr 2026 07:16:02 -0700 (PDT) Received: from lgs.. ([2409:893d:1188:142d:6c67:74e8:5200:1f39]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-82f0c4b17fcsm11396301b3a.33.2026.04.13.07.15.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Apr 2026 07:16:02 -0700 (PDT) From: Guangshuo Li To: Thierry Reding , Mikko Perttunen , David Airlie , Simona Vetter , Mark Zhang , Sean Paul , dri-devel@lists.freedesktop.org, linux-tegra@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li , stable@vger.kernel.org Subject: [PATCH v3] gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path Date: Mon, 13 Apr 2026 22:15:26 +0800 Message-ID: <20260413141526.2961841-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" After device_initialize(), the embedded struct device in struct host1x_device should be released through the device core with put_device(). In host1x_device_add(), if host1x_device_parse_dt() fails, the current error path frees the object directly with kfree(device). That bypasses the normal device lifetime handling and leaks the reference held on the embedded struct device. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix this by using put_device() in the host1x_device_parse_dt() failure path. Fixes: f4c5cf88fbd50 ("gpu: host1x: Provide a proper struct bus_type") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Acked-by: Mikko Perttunen --- v3: - note that the issue was identified by my static analysis tool - and confirmed by manual review v2: - add Cc: stable@vger.kernel.org drivers/gpu/host1x/bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c index 63fe037c3b65..e3ac85848aec 100644 --- a/drivers/gpu/host1x/bus.c +++ b/drivers/gpu/host1x/bus.c @@ -452,7 +452,7 @@ static int host1x_device_add(struct host1x *host1x, =20 err =3D host1x_device_parse_dt(device, driver); if (err < 0) { - kfree(device); + put_device(&device->dev); return err; } =20 --=20 2.43.0