From nobody Tue Jun 16 03:48:01 2026 Received: from mail-pf1-f180.google.com (mail-pf1-f180.google.com [209.85.210.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DA20F32E126 for ; Wed, 15 Apr 2026 19:03:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776279810; cv=none; b=M9MgmbGoFSSiLiSpFru9KgBX6nQPEn6va6fUE8en/6Xwkn9wFKztd5YQ88slHTOdmxcOO6mpqlTK3T6J/HtS1vC7xxW+94tO4FqT4hjsqD3QqKZ4MR5bBMi8ufPBZp/SZkMZkRIxxBlN/40EwaayqBpCyG7tTVgPzxWVZchlkpk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776279810; c=relaxed/simple; bh=9UFC+iDWRtJNrO7vNXJjscF75KHcs20tnIoUObrAcx4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=UHs5tLRjEa6JLZ+WfM3DULe6ZGC3F9aWuCdMr8l/RDd+IpPYyf7OTueqFcnMMG0uWVdgKyqgGR4u3FBdgXiDxN6/18KRkkAWogUPeKhpWlWcBlyjgFsxsRNq4qlGRlFY8sFWvc7njVGRGZ6bi98jw3ndxwSgL6D5BrWX5TkS93c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dqnXHjLf; arc=none smtp.client-ip=209.85.210.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dqnXHjLf" Received: by mail-pf1-f180.google.com with SMTP id d2e1a72fcca58-823c56765fdso3984930b3a.1 for ; Wed, 15 Apr 2026 12:03:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776279808; x=1776884608; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=2uvy87bgL4dIY+61I0JGqZLh1grbMWSFcGN37dMr2Ck=; b=dqnXHjLfjZFiXWVlhWWpzGHUvRpf0Zzkf1WUXCWIXXZsYgYarAI1PMB2UVDSgj7fIj r3KquMtuR/uDWyUqqKJmPRBhoCDQjtUOCsGAK87Q0wCj3iLMLbgk3fUIKNtEHkdyCt2I okJU+A99EN/xAZpRhsvmQ+DmsRu/iZuc1np8r9v5ANrup04EWC7/9u6Cdv8r8k3jQZTX NQl+/jkdBerwZimZ94EGlFiNZygJ5UYlWk+YdhKPGFDSdedegLXcsQcQyCD/XAO+GyOc +n2a5QhkMdRY/o7PfgLDoPOiR9y9UFj3exVj3yUPaUHOzOQhAaZi/lh8FtkaJ4oOI/aU ho2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776279808; x=1776884608; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=2uvy87bgL4dIY+61I0JGqZLh1grbMWSFcGN37dMr2Ck=; b=Q0+/GDFVHhWoAeeIb3TJmj75drX3HoCfspRgNLGwCxBTjz6uQasNLkQRcNzjCptl6X 3A4r7KdmD0kIzZw/jJom9n1fPc0HPdKcD9ws6YZKPmGNR5Z6lLdPb5aBIDdR39vniM5f yCEOh5pclN/d5pGeooghWCn7mVwzv5kLcEXE2l0TOYr8HdrWhtRVbWgPVGUYTpcW6pft yyuft8Epn768USOC563OllS1V12TbhzM1UwSWm6ySTT5RiC5wU4Yf4hixseh0eyTDRc6 zPJpct3AMbWA/VTcs77R1AWGLK+7pDTGlPzKOawSM9UETdVMOPVPjfgznJC/Ii2whsIY HQHg== X-Forwarded-Encrypted: i=1; AFNElJ/Vz8uGtEVJ6KCG04OkKl1tqpX+OEOef9ckctNI5r3SXiQT2PdKwau5VmSm1kmal5gtrd6yr7qY14aV6EU=@vger.kernel.org X-Gm-Message-State: AOJu0YzJ0WLCjsdI4pfjGO2gj12uuA7Va3nbbZhPAy3CCq/tUBwszh32 O8hDtrs8mY74TNKMlIHYu7AA4L/QifgkxtrLTVADutVjcwW2ubhITmiE X-Gm-Gg: AeBDietCHzf3DCDcD1+U4oF6e5W9M6dQinSOKYUE6jXV24MQw2iXNBmwDlm3m2odCir GEh1BhEvd/k68K2ugNxshPTZzNF3sF7aIj/XH9/ilfn0rEQ0rTUT9NDwCzZ2ZWS4urpy33ExgMF zOOjqmjQXH6m2q2b4IqTfZo4K9usvjlKwNlJlS7qg3uf0MYZbBgk+hLIQ5Dx380ZHPwJ07Twm1m ZNTx+0+5Rar7dBNR2LovgQQ6OBMHPQu/x7Z/1G1vK9url0Ukk3vdNNhlfQFz7aNPBRtWY79+M5p esDnywQZQBaRdFmieKtU7MCCeA2RhD0HFcDowv0IxJodjDtnVtevsgJl3nGpQ+NMV4eEfw3Ciqg xm8G0Z9xKN2hpmvEOAyN1J8YzV69nHfohJPmMUkgxIhfkobBYgqg4FiQ/iKtzW+81GrdwHrEgUG cpdxojINddtCuX9LVqy/B3soRaay7JOAeh9HE= X-Received: by 2002:a05:6a00:bd91:b0:829:73f4:6ff with SMTP id d2e1a72fcca58-82f0c2b44a4mr22867066b3a.37.1776279808216; Wed, 15 Apr 2026 12:03:28 -0700 (PDT) Received: from lgs.. ([2409:893d:1171:10e2:93ee:194:b07d:a9b2]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-82f6f52d45asm1736491b3a.38.2026.04.15.12.03.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Apr 2026 12:03:27 -0700 (PDT) From: Guangshuo Li To: Greg Kroah-Hartman , Guangshuo Li , Kees Cook , David Brownell , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Subject: [PATCH] usb: sl811_cs: fix failed platform device registration cleanup Date: Thu, 16 Apr 2026 03:03:18 +0800 Message-ID: <20260415190318.3812066-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When platform_device_register() fails in sl811_hc_init(), the embedded struct device in platform_dev has already been initialized by device_initialize(), but the failure path returns the error without dropping the device reference for the current platform device: sl811_hc_init() -> platform_device_register(&platform_dev) -> device_initialize(&platform_dev.dev) -> setup_pdev_dma_masks(&platform_dev) -> platform_device_add(&platform_dev) This leads to a reference leak when platform_device_register() fails. Manual review also shows that sl811_hc_init() sets platform_dev.dev.parent before calling platform_device_register(), but does not clear it on failure. As a result, later calls may incorrectly see the device as busy. Fix this by calling platform_device_put() and clearing platform_dev.dev.parent when platform_device_register() fails. Also make sl811_cs_release() only unregister the platform device when it belongs to the current pcmcia device. The reference leak was identified by a static analysis tool I developed and confirmed by manual review. Fixes: c6de2b64eb575 ("[PATCH] USB: add sl811_cs support") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/usb/host/sl811_cs.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/drivers/usb/host/sl811_cs.c b/drivers/usb/host/sl811_cs.c index ada91ca33f65..096f5fff0bfb 100644 --- a/drivers/usb/host/sl811_cs.c +++ b/drivers/usb/host/sl811_cs.c @@ -90,6 +90,8 @@ static struct platform_device platform_dev =3D { static int sl811_hc_init(struct device *parent, resource_size_t base_addr, int irq) { + int ret; + if (platform_dev.dev.parent) return -EBUSY; platform_dev.dev.parent =3D parent; @@ -108,7 +110,13 @@ static int sl811_hc_init(struct device *parent, resour= ce_size_t base_addr, * by referencing "sl811h_driver". */ platform_dev.name =3D sl811h_driver.driver.name; - return platform_device_register(&platform_dev); + ret =3D platform_device_register(&platform_dev); + if (ret) { + platform_device_put(&platform_dev); + platform_dev.dev.parent =3D NULL; + } + + return ret; } =20 /*=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D*/ @@ -128,7 +136,10 @@ static void sl811_cs_release(struct pcmcia_device * li= nk) dev_dbg(&link->dev, "sl811_cs_release\n"); =20 pcmcia_disable_device(link); - platform_device_unregister(&platform_dev); + if (platform_dev.dev.parent =3D=3D &link->dev) + platform_device_unregister(&platform_dev); + platform_dev.dev.parent =3D NULL; + } =20 static int sl811_cs_config_check(struct pcmcia_device *p_dev, void *priv_d= ata) --=20 2.43.0