[PATCH v1] bus: mhi: ep: Fix device refcount leak on create failure

[PATCH v1] bus: mhi: ep: Fix device refcount leak on create failure

[Yuho Choi]

mhi_ep_create_device() takes one device reference for the UL channel and
another for the DL channel after allocating the transfer device. These
references are normally released by mhi_ep_destroy_device() before the
device itself is removed.

If dev_set_name() or device_add() fails, the error path currently drops
only one reference. The remaining channel references keep the device
from being released and leave the channels associated with a device that
was never registered.

Route both failures through a common unwind path that drops the DL
channel reference, the UL channel reference, and the initial reference
from device_initialize().

Fixes: 297c77a0f273 ("bus: mhi: ep: Add support for creating and destroying MHI EP devices")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---
 drivers/bus/mhi/ep/main.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c
index 0277e1ab1198..34d3662eb091 100644
--- a/drivers/bus/mhi/ep/main.c
+++ b/drivers/bus/mhi/ep/main.c
@@ -1338,15 +1338,19 @@ static int mhi_ep_create_device(struct mhi_ep_cntrl *mhi_cntrl, u32 ch_id)
 	ret = dev_set_name(&mhi_dev->dev, "%s_%s",
 		     dev_name(&mhi_cntrl->mhi_dev->dev),
 		     mhi_dev->name);
-	if (ret) {
-		put_device(&mhi_dev->dev);
-		return ret;
-	}
+	if (ret)
+		goto err_put_channels;
 
 	ret = device_add(&mhi_dev->dev);
 	if (ret)
-		put_device(&mhi_dev->dev);
+		goto err_put_channels;
+
+	return 0;
 
+err_put_channels:
+	put_device(&mhi_dev->dev); /* DL channel reference */
+	put_device(&mhi_dev->dev); /* UL channel reference */
+	put_device(&mhi_dev->dev); /* device_initialize() reference */
 	return ret;
 }
 
-- 
2.43.0

Re: [PATCH v1] bus: mhi: ep: Fix device refcount leak on create failure

[최유호]

Hi,

Just a gentle ping on this patch.

I would appreciate any feedback when you have a chance to review this.

Thanks

Re: [PATCH v1] bus: mhi: ep: Fix device refcount leak on create failure

[Manivannan Sadhasivam]

On Wed, Jun 03, 2026 at 03:51:42PM -0400, Yuho Choi wrote:
> mhi_ep_create_device() takes one device reference for the UL channel and
> another for the DL channel after allocating the transfer device. These
> references are normally released by mhi_ep_destroy_device() before the
> device itself is removed.
> 
> If dev_set_name() or device_add() fails, the error path currently drops
> only one reference. The remaining channel references keep the device
> from being released and leave the channels associated with a device that
> was never registered.
> 
> Route both failures through a common unwind path that drops the DL
> channel reference, the UL channel reference, and the initial reference
> from device_initialize().
> 
> Fixes: 297c77a0f273 ("bus: mhi: ep: Add support for creating and destroying MHI EP devices")
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>

LGTM! But this patch can only be applied when v7.2-rc1 is released.

- Mani

> ---
>  drivers/bus/mhi/ep/main.c | 14 +++++++++-----
>  1 file changed, 9 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c
> index 0277e1ab1198..34d3662eb091 100644
> --- a/drivers/bus/mhi/ep/main.c
> +++ b/drivers/bus/mhi/ep/main.c
> @@ -1338,15 +1338,19 @@ static int mhi_ep_create_device(struct mhi_ep_cntrl *mhi_cntrl, u32 ch_id)
>  	ret = dev_set_name(&mhi_dev->dev, "%s_%s",
>  		     dev_name(&mhi_cntrl->mhi_dev->dev),
>  		     mhi_dev->name);
> -	if (ret) {
> -		put_device(&mhi_dev->dev);
> -		return ret;
> -	}
> +	if (ret)
> +		goto err_put_channels;
>  
>  	ret = device_add(&mhi_dev->dev);
>  	if (ret)
> -		put_device(&mhi_dev->dev);
> +		goto err_put_channels;
> +
> +	return 0;
>  
> +err_put_channels:
> +	put_device(&mhi_dev->dev); /* DL channel reference */
> +	put_device(&mhi_dev->dev); /* UL channel reference */
> +	put_device(&mhi_dev->dev); /* device_initialize() reference */
>  	return ret;
>  }
>  
> -- 
> 2.43.0
> 

-- 
மணிவண்ணன் சதாசிவம்