From: Guangshuo Li <lgs201920130244@gmail.com>
To: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>,
Borislav Petkov <bp@alien8.de>, Tony Luck <tony.luck@intel.com>,
linux-edac@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: Guangshuo Li <lgs201920130244@gmail.com>, stable@vger.kernel.org
Subject: [PATCH] EDAC/versalnet: fix memory leak on device registration failure
Date: Sun, 20 Sep 2026 13:55:19 +0800 [thread overview]
Message-ID: <20260920055519.3778269-1-lgs201920130244@gmail.com> (raw)
init_one_mc() allocates dev with kzalloc() and registers it with
device_register(). If device_register() fails, the device has already
been initialized and holds its initial device reference.
The current error path eventually frees dev directly with kfree().
This bypasses the device release path and can leak driver-core
resources associated with the initialized device. The existing
versal_edac_release() callback is responsible for freeing dev once the
device reference reaches zero.
Call put_device() when device_register() fails so the initialized
device reference is dropped and versal_edac_release() performs the
proper cleanup. Return after freeing mci to avoid falling through to
the direct kfree() path, which remains necessary for failures that
occur before device_register() is called.
The issue was identified by a static analysis tool I developed and
confirmed by manual review.
Fixes: d5fe2fec6c40 ("EDAC: Add a driver for the AMD Versal NET DDR controller")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
drivers/edac/versalnet_edac.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/edac/versalnet_edac.c b/drivers/edac/versalnet_edac.c
index 3a06b41c1d84..db3bf5a1345b 100644
--- a/drivers/edac/versalnet_edac.c
+++ b/drivers/edac/versalnet_edac.c
@@ -829,8 +829,10 @@ static int init_one_mc(struct mc_priv *priv, struct platform_device *pdev, int i
dev->release = versal_edac_release;
rc = device_register(dev);
- if (rc)
+ if (rc) {
+ put_device(dev);
goto err_mc_free;
+ }
mci->pdev = dev;
mc_init(mci, dev);
@@ -852,9 +854,9 @@ static int init_one_mc(struct mc_priv *priv, struct platform_device *pdev, int i
device_unregister(mci->pdev);
err_mc_free:
edac_mc_free(mci);
+ return rc;
err_dev_free:
kfree(dev);
-
return rc;
}
--
2.43.0
next reply other threads:[~2026-09-20 5:55 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-20 5:55 Guangshuo Li [this message]
2026-09-21 15:11 ` krzk
2026-09-22 2:57 ` Guangshuo Li
2026-09-21 15:17 ` krzk
2026-09-23 15:02 ` Shubhrajyoti Datta
2026-09-24 14:15 ` Guangshuo Li
2026-09-30 4:56 ` Shubhrajyoti Datta
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260920055519.3778269-1-lgs201920130244@gmail.com \
--to=lgs201920130244@gmail.com \
--cc=bp@alien8.de \
--cc=linux-edac@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=shubhrajyoti.datta@amd.com \
--cc=stable@vger.kernel.org \
--cc=tony.luck@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®