When platform_device_register() fails in vim2m_init(), the embedded
struct device in vim2m_pdev has already been initialized by
device_initialize(), but the failure path returns the error without
dropping the device reference for the current platform device:

  vim2m_init()
    -> platform_device_register(&vim2m_pdev)
       -> device_initialize(&vim2m_pdev.dev)
       -> setup_pdev_dma_masks(&vim2m_pdev)
       -> platform_device_add(&vim2m_pdev)

This leads to a reference leak when platform_device_register() fails.
Fix this by calling platform_device_put() before returning the error.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: 1f923a42033ad ("[media] mem2mem_testdev: rename to vim2m")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/media/test-drivers/vim2m.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/test-drivers/vim2m.c b/drivers/media/test-drivers/vim2m.c
index bb2dd11eef0e..80dc7edcbb5e 100644
--- a/drivers/media/test-drivers/vim2m.c
+++ b/drivers/media/test-drivers/vim2m.c
@@ -1601,8 +1601,10 @@ static int __init vim2m_init(void)
 	int ret;
 
 	ret = platform_device_register(&vim2m_pdev);
-	if (ret)
+	if (ret) {
+		platform_device_put(&vim2m_pdev);
 		return ret;
+	}
 
 	ret = platform_driver_register(&vim2m_pdrv);
 	if (ret)
-- 
2.43.0

On Wed, Apr 15, 2026 at 11:14:49PM +0800, Guangshuo Li wrote:
> When platform_device_register() fails in vim2m_init(), the embedded
> struct device in vim2m_pdev has already been initialized by
> device_initialize(), but the failure path returns the error without
> dropping the device reference for the current platform device:
> 
>   vim2m_init()
>     -> platform_device_register(&vim2m_pdev)
>        -> device_initialize(&vim2m_pdev.dev)
>        -> setup_pdev_dma_masks(&vim2m_pdev)
>        -> platform_device_add(&vim2m_pdev)
> 
> This leads to a reference leak when platform_device_register() fails.
> Fix this by calling platform_device_put() before returning the error.

Functions that don't clean after themselves on failure are not a very
good practice. It indeed seems that platform_device_register() will
leave a dangling kref. Most callers don't seem to be aware of this
though, even platform_add_devices() doesn't call platform_device_put() !
This makes me think that this patch just works around the problem. A
better solution is needed. Have you investigated if
platform_device_register() can drop the reference on failure ? What
problems would that cause ?

> The issue was identified by a static analysis tool I developed and
> confirmed by manual review.
> 
> Fixes: 1f923a42033ad ("[media] mem2mem_testdev: rename to vim2m")

Quote unlikely.

> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/media/test-drivers/vim2m.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/test-drivers/vim2m.c b/drivers/media/test-drivers/vim2m.c
> index bb2dd11eef0e..80dc7edcbb5e 100644
> --- a/drivers/media/test-drivers/vim2m.c
> +++ b/drivers/media/test-drivers/vim2m.c
> @@ -1601,8 +1601,10 @@ static int __init vim2m_init(void)
>  	int ret;
>  
>  	ret = platform_device_register(&vim2m_pdev);
> -	if (ret)
> +	if (ret) {
> +		platform_device_put(&vim2m_pdev);
>  		return ret;
> +	}
>  
>  	ret = platform_driver_register(&vim2m_pdrv);
>  	if (ret)

-- 
Regards,

Laurent Pinchart

Hi Laurent,

Thanks for the review.

On Thu, 16 Apr 2026 at 17:49, Laurent Pinchart
<laurent.pinchart@ideasonboard.com> wrote:
>

> Functions that don't clean after themselves on failure are not a very
> good practice. It indeed seems that platform_device_register() will
> leave a dangling kref. Most callers don't seem to be aware of this
> though, even platform_add_devices() doesn't call platform_device_put() !
> This makes me think that this patch just works around the problem. A
> better solution is needed. Have you investigated if
> platform_device_register() can drop the reference on failure ? What
> problems would that cause ?
>
> > The issue was identified by a static analysis tool I developed and
> > confirmed by manual review.
> >
> > Fixes: 1f923a42033ad ("[media] mem2mem_testdev: rename to vim2m")
>
> Quote unlikely.
>


You are right, this may be a workaround rather than the best fix if the
underlying issue is really in the platform_device_register() failure
semantics.

There is also discussion along the same lines in another patch caused by
the same API pattern:
https://patchew.org/linux/20260415174159.3625777-1-lgs201920130244@gmail.com/

We are discussing there whether there is a better fix at the API/core
level instead of handling individual callers one by one.

Thanks,
Guangshuo