pnp_device_probe() attaches the PNP device before it activates or
disables its resources.  The attach changes the status from PNP_READY
to PNP_ATTACHED, but errors from either resource transition return
directly and leave that status behind.  A later bind or manual PNP
configuration attempt then sees a device that is still marked in use.

Route both errors through the existing failure path so it restores the
status to PNP_READY.  Do not disable the device or clean its resources:
pnp_activate_dev() only marks it active after a successful start, while
pnp_disable_dev() preserves the active state and resource table when
stopping fails.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/pnp/driver.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pnp/driver.c b/drivers/pnp/driver.c
index 6d58b1465081..80c2a0f15b80 100644
--- a/drivers/pnp/driver.c
+++ b/drivers/pnp/driver.c
@@ -96,13 +96,13 @@ static int pnp_device_probe(struct device *dev)
 		if (!(pnp_drv->flags & PNP_DRIVER_RES_DO_NOT_CHANGE)) {
 			error = pnp_activate_dev(pnp_dev);
 			if (error < 0)
-				return error;
+				goto fail;
 		}
 	} else if ((pnp_drv->flags & PNP_DRIVER_RES_DISABLE)
 		   == PNP_DRIVER_RES_DISABLE) {
 		error = pnp_disable_dev(pnp_dev);
 		if (error < 0)
-			return error;
+			goto fail;
 	}
 	error = 0;
 	if (pnp_drv->probe) {
-- 
2.50.1

On Thu, Sep 10, 2026 at 10:37 PM Myeonghun Pak <mhun512@gmail.com> wrote:
>
> pnp_device_probe() attaches the PNP device before it activates or
> disables its resources.  The attach changes the status from PNP_READY
> to PNP_ATTACHED, but errors from either resource transition return
> directly and leave that status behind.  A later bind or manual PNP
> configuration attempt then sees a device that is still marked in use.
>
> Route both errors through the existing failure path so it restores the
> status to PNP_READY.  Do not disable the device or clean its resources:
> pnp_activate_dev() only marks it active after a successful start, while
> pnp_disable_dev() preserves the active state and resource table when
> stopping fails.
>
> This issue was identified during our ongoing static-analysis research while
> reviewing kernel code.
>
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> ---
>  drivers/pnp/driver.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/pnp/driver.c b/drivers/pnp/driver.c
> index 6d58b1465081..80c2a0f15b80 100644
> --- a/drivers/pnp/driver.c
> +++ b/drivers/pnp/driver.c
> @@ -96,13 +96,13 @@ static int pnp_device_probe(struct device *dev)
>                 if (!(pnp_drv->flags & PNP_DRIVER_RES_DO_NOT_CHANGE)) {
>                         error = pnp_activate_dev(pnp_dev);
>                         if (error < 0)
> -                               return error;
> +                               goto fail;
>                 }
>         } else if ((pnp_drv->flags & PNP_DRIVER_RES_DISABLE)
>                    == PNP_DRIVER_RES_DISABLE) {
>                 error = pnp_disable_dev(pnp_dev);
>                 if (error < 0)
> -                       return error;
> +                       goto fail;
>         }
>         error = 0;
>         if (pnp_drv->probe) {
> --

Applied as 7.4 material, thanks!