[PATCH v2] soc: mpfs: use kref cleanup on probe failure

[PATCH v2] soc: mpfs: use kref cleanup on probe failure

[Guangshuo Li]

After kref_init(), the device_get_match_data() failure path frees the
mailbox channel and sys_controller directly, bypassing the matching
kref_put() for the initial reference.

Use mpfs_sys_controller_put() on this path so that the initial
reference established by kref_init() is released through the existing
kref release callback.

Rename the error label to reflect that cleanup is now performed
through the kref helper.

This issue was found by manual code inspection.

Fixes: 75ef23397558 ("soc: microchip: mpfs-sys-controller: fix resource leak on probe error")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
v2:
  - Add the missing Signed-off-by tag.
  - Rename out_free_channel to out_put as suggested by Felix.

 drivers/soc/microchip/mpfs-sys-controller.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/soc/microchip/mpfs-sys-controller.c b/drivers/soc/microchip/mpfs-sys-controller.c
index 0400a01b2338..ef27e1083f0f 100644
--- a/drivers/soc/microchip/mpfs-sys-controller.c
+++ b/drivers/soc/microchip/mpfs-sys-controller.c
@@ -159,7 +159,7 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
 	of_data = (struct mpfs_syscon_config *) device_get_match_data(dev);
 	if (!of_data) {
 		ret = dev_err_probe(dev, -EINVAL, "Error getting match data\n");
-		goto out_free_channel;
+		goto out_put;
 	}
 
 	for (i = 0; i < of_data->nb_subdevs; i++) {
@@ -173,8 +173,9 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
 
 	return 0;
 
-out_free_channel:
-	mbox_free_channel(sys_controller->chan);
+out_put:
+	mpfs_sys_controller_put(sys_controller);
+	return ret;
 out_free:
 	kfree(sys_controller);
 	return ret;
-- 
2.43.0

Re: [PATCH v2] soc: mpfs: use kref cleanup on probe failure

[Conor Dooley]

[-- Attachment #1: Type: text/plain, Size: 1972 bytes --]

On Wed, Oct 07, 2026 at 08:17:43PM +0800, Guangshuo Li wrote:
> After kref_init(), the device_get_match_data() failure path frees the
> mailbox channel and sys_controller directly, bypassing the matching
> kref_put() for the initial reference.
> 
> Use mpfs_sys_controller_put() on this path so that the initial
> reference established by kref_init() is released through the existing
> kref release callback.
> 
> Rename the error label to reflect that cleanup is now performed
> through the kref helper.
> 
> This issue was found by manual code inspection.
> 
> Fixes: 75ef23397558 ("soc: microchip: mpfs-sys-controller: fix resource leak on probe error")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
> v2:
>   - Add the missing Signed-off-by tag.
>   - Rename out_free_channel to out_put as suggested by Felix.

Applied, thanks.

Cheers,
Conor.

> 
>  drivers/soc/microchip/mpfs-sys-controller.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/soc/microchip/mpfs-sys-controller.c b/drivers/soc/microchip/mpfs-sys-controller.c
> index 0400a01b2338..ef27e1083f0f 100644
> --- a/drivers/soc/microchip/mpfs-sys-controller.c
> +++ b/drivers/soc/microchip/mpfs-sys-controller.c
> @@ -159,7 +159,7 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
>  	of_data = (struct mpfs_syscon_config *) device_get_match_data(dev);
>  	if (!of_data) {
>  		ret = dev_err_probe(dev, -EINVAL, "Error getting match data\n");
> -		goto out_free_channel;
> +		goto out_put;
>  	}
>  
>  	for (i = 0; i < of_data->nb_subdevs; i++) {
> @@ -173,8 +173,9 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
>  
>  	return 0;
>  
> -out_free_channel:
> -	mbox_free_channel(sys_controller->chan);
> +out_put:
> +	mpfs_sys_controller_put(sys_controller);
> +	return ret;
>  out_free:
>  	kfree(sys_controller);
>  	return ret;
> -- 
> 2.43.0
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]