[PATCH] hwmon: (applesmc) fix key backlight workqueue leak on register failure

[PATCH] hwmon: (applesmc) fix key backlight workqueue leak on register failure

[Cong Nguyen]

applesmc_create_key_backlight() allocates applesmc_led_wq before calling
led_classdev_register(). When register fails, the error is returned to
applesmc_init(), which jumps to out_light_sysfs and skips
applesmc_release_key_backlight(), leaking the workqueue.

Destroy the workqueue on the register failure path. The bug was introduced
when the inline init block was refactored into a helper that returns errors
directly, dropping the old out_light_wq unwind label.

Fixes: 0b0b5dff8967 ("hwmon: (applesmc) Simplify feature sysfs handling")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
---
 drivers/hwmon/applesmc.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 90a14a7f2c4c..bfe9c5b0c4f1 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -1249,12 +1249,17 @@ static void applesmc_release_light_sensor(void)
 
 static int applesmc_create_key_backlight(void)
 {
+	int ret;
+
 	if (!smcreg.has_key_backlight)
 		return 0;
 	applesmc_led_wq = create_singlethread_workqueue("applesmc-led");
 	if (!applesmc_led_wq)
 		return -ENOMEM;
-	return led_classdev_register(&pdev->dev, &applesmc_backlight);
+	ret = led_classdev_register(&pdev->dev, &applesmc_backlight);
+	if (ret)
+		destroy_workqueue(applesmc_led_wq);
+	return ret;
 }
 
 static void applesmc_release_key_backlight(void)
-- 
2.25.1

Re: [PATCH] hwmon: (applesmc) fix key backlight workqueue leak on register failure

[Guenter Roeck]

On Fri, Aug 28, 2026 at 05:54:13PM +0700, Cong Nguyen wrote:
> applesmc_create_key_backlight() allocates applesmc_led_wq before calling
> led_classdev_register(). When register fails, the error is returned to
> applesmc_init(), which jumps to out_light_sysfs and skips
> applesmc_release_key_backlight(), leaking the workqueue.
> 
> Destroy the workqueue on the register failure path. The bug was introduced
> when the inline init block was refactored into a helper that returns errors
> directly, dropping the old out_light_wq unwind label.
> 
> Fixes: 0b0b5dff8967 ("hwmon: (applesmc) Simplify feature sysfs handling")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4
> Signed-off-by: Cong Nguyen <congnt264@gmail.com>

Applied.

Thanks,
Guenter