[PATCH] leds: blinkm: Remove sysfs group on allocation failure

[PATCH] leds: blinkm: Remove sysfs group on allocation failure

[Myeonghun Pak]

register_multicolor() returns on allocation failure without removing the
sysfs group created by blinkm_probe(). Remove it on this path, matching
the helper's existing LED registration error cleanup.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 56e8c56c9af0 ("leds: Add multicolor support to BlinkM LED driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
 drivers/leds/leds-blinkm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/leds/leds-blinkm.c b/drivers/leds/leds-blinkm.c
--- a/drivers/leds/leds-blinkm.c
+++ b/drivers/leds/leds-blinkm.c
@@ -691,8 +691,10 @@ static int register_multicolor(struct i2c_client *client, struct blinkm_data *da
 
 	mc_led_info = devm_kcalloc(&client->dev, NUM_LEDS, sizeof(*mc_led_info),
 					GFP_KERNEL);
-	if (!mc_led_info)
+	if (!mc_led_info) {
+		sysfs_remove_group(&client->dev.kobj, &blinkm_group);
 		return -ENOMEM;
+	}
 
 	mc_led_info[RED].color_index = LED_COLOR_ID_RED;
 	mc_led_info[GREEN].color_index = LED_COLOR_ID_GREEN;

Re: [PATCH] leds: blinkm: Remove sysfs group on allocation failure

[Lee Jones]

On Mon, 14 Sep 2026, Myeonghun Pak wrote:

> register_multicolor() returns on allocation failure without removing the
> sysfs group created by blinkm_probe(). Remove it on this path, matching
> the helper's existing LED registration error cleanup.
> 
> This issue was identified during our ongoing static-analysis research
> while reviewing kernel code.
> 
> Fixes: 56e8c56c9af0 ("leds: Add multicolor support to BlinkM LED driver")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> ---
>  drivers/leds/leds-blinkm.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/leds/leds-blinkm.c b/drivers/leds/leds-blinkm.c
> --- a/drivers/leds/leds-blinkm.c
> +++ b/drivers/leds/leds-blinkm.c
> @@ -691,8 +691,10 @@ static int register_multicolor(struct i2c_client *client, struct blinkm_data *da
>  
>  	mc_led_info = devm_kcalloc(&client->dev, NUM_LEDS, sizeof(*mc_led_info),
>  					GFP_KERNEL);
> -	if (!mc_led_info)
> +	if (!mc_led_info) {
> +		sysfs_remove_group(&client->dev.kobj, &blinkm_group);

If 'blinkm_group' was created in blinkm_probe(), shouldn't it be cleaned up in
the error path of 'blinkm_probe()' rather than here in the callee?

>  		return -ENOMEM;
> +	}
>  
>  	mc_led_info[RED].color_index = LED_COLOR_ID_RED;
>  	mc_led_info[GREEN].color_index = LED_COLOR_ID_GREEN;

-- 
Lee Jones

Re: [PATCH] leds: blinkm: Remove sysfs group on allocation failure

[Lee Jones]

On Tue, 22 Sep 2026, Lee Jones wrote:

> On Mon, 14 Sep 2026, Myeonghun Pak wrote:
> 
> > register_multicolor() returns on allocation failure without removing the
> > sysfs group created by blinkm_probe(). Remove it on this path, matching
> > the helper's existing LED registration error cleanup.
> > 
> > This issue was identified during our ongoing static-analysis research
> > while reviewing kernel code.
> > 
> > Fixes: 56e8c56c9af0 ("leds: Add multicolor support to BlinkM LED driver")
> > Cc: stable@vger.kernel.org
> > Assisted-by: LLM
> > Co-developed-by: Ijae Kim <ae878000@gmail.com>
> > Signed-off-by: Ijae Kim <ae878000@gmail.com>
> > Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> > ---
> >  drivers/leds/leds-blinkm.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/leds/leds-blinkm.c b/drivers/leds/leds-blinkm.c
> > --- a/drivers/leds/leds-blinkm.c
> > +++ b/drivers/leds/leds-blinkm.c
> > @@ -691,8 +691,10 @@ static int register_multicolor(struct i2c_client *client, struct blinkm_data *da
> >  
> >  	mc_led_info = devm_kcalloc(&client->dev, NUM_LEDS, sizeof(*mc_led_info),
> >  					GFP_KERNEL);
> > -	if (!mc_led_info)
> > +	if (!mc_led_info) {
> > +		sysfs_remove_group(&client->dev.kobj, &blinkm_group);
> 
> If 'blinkm_group' was created in blinkm_probe(), shouldn't it be cleaned up in
> the error path of 'blinkm_probe()' rather than here in the callee?

Same with register_separate_colors() failure, no?

> 
> >  		return -ENOMEM;
> > +	}
> >  
> >  	mc_led_info[RED].color_index = LED_COLOR_ID_RED;
> >  	mc_led_info[GREEN].color_index = LED_COLOR_ID_GREEN;
> 
> -- 
> Lee Jones

-- 
Lee Jones

Re: [PATCH] leds: blinkm: Remove sysfs group on allocation failure

[Lee Jones]

On Tue, 22 Sep 2026, Lee Jones wrote:

> On Tue, 22 Sep 2026, Lee Jones wrote:
> 
> > On Mon, 14 Sep 2026, Myeonghun Pak wrote:
> > 
> > > register_multicolor() returns on allocation failure without removing the
> > > sysfs group created by blinkm_probe(). Remove it on this path, matching
> > > the helper's existing LED registration error cleanup.
> > > 
> > > This issue was identified during our ongoing static-analysis research
> > > while reviewing kernel code.
> > > 
> > > Fixes: 56e8c56c9af0 ("leds: Add multicolor support to BlinkM LED driver")
> > > Cc: stable@vger.kernel.org
> > > Assisted-by: LLM
> > > Co-developed-by: Ijae Kim <ae878000@gmail.com>
> > > Signed-off-by: Ijae Kim <ae878000@gmail.com>
> > > Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> > > ---
> > >  drivers/leds/leds-blinkm.c | 4 +++-
> > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/drivers/leds/leds-blinkm.c b/drivers/leds/leds-blinkm.c
> > > --- a/drivers/leds/leds-blinkm.c
> > > +++ b/drivers/leds/leds-blinkm.c
> > > @@ -691,8 +691,10 @@ static int register_multicolor(struct i2c_client *client, struct blinkm_data *da
> > >  
> > >  	mc_led_info = devm_kcalloc(&client->dev, NUM_LEDS, sizeof(*mc_led_info),
> > >  					GFP_KERNEL);
> > > -	if (!mc_led_info)
> > > +	if (!mc_led_info) {
> > > +		sysfs_remove_group(&client->dev.kobj, &blinkm_group);
> > 
> > If 'blinkm_group' was created in blinkm_probe(), shouldn't it be cleaned up in
> > the error path of 'blinkm_probe()' rather than here in the callee?
> 
> Same with register_separate_colors() failure, no?

What about:

diff --git a/drivers/leds/leds-blinkm.c b/drivers/leds/leds-blinkm.c
index ee1589015826..7932095780aa 100644
--- a/drivers/leds/leds-blinkm.c
+++ b/drivers/leds/leds-blinkm.c
@@ -749,19 +749,17 @@ static int blinkm_probe(struct i2c_client *client)
                return err;
        }
 
-       if (!IS_ENABLED(CONFIG_LEDS_BLINKM_MULTICOLOR)) {
+       if (!IS_ENABLED(CONFIG_LEDS_BLINKM_MULTICOLOR))
                err = register_separate_colors(client, data);
-               if (err < 0)
-                       return err;
-       } else {
+        else
                err = register_multicolor(client, data);
-               if (err < 0)
-                       return err;
-       }
 
-       blinkm_init_hw(client);
+       if (err < 0)
+               sysfs_remove_group(&client->dev.kobj, &blinkm_group);
+       else
+               blinkm_init_hw(client);
 
-       return 0;
+       return err;
 }

This is completely untested.

-- 
Lee Jones