[PATCH v2] remoteproc: core: Do not put the device when device_add() fails

[PATCH v2] remoteproc: core: Do not put the device when device_add() fails

[Yuqiang Sun]

In rproc_add(), put_device() is called when device_add() fails.
But st_slim_rproc_alloc(), xlnx_r5_remoteproc and the other 23
drivers (which use devm_rproc_alloc() and so devm_rproc_free()) then
call rproc_free(), which puts the device again. The reference is
dropped twice, and st_slim_rproc_alloc() uses the rproc after it is
freed.

Remove the put_device() in rproc_add() and add a comment saying why.

Fixes: 7dbdb8bd7c02 ("remoteproc: core: Cleanup device in case of failure")
Cc: stable@vger.kernel.org
Signed-off-by: Yuqiang Sun <izaiahsun@gmail.com>
---

Notes:
    Changes in v2:
    - Comment in the device_add() failure branch (Mathieu).
    - Shorter changelog.
    - Rebased on rproc-next.
    
    Bug was found by kbound, an internal static analysis prototype.
    The reproduction was assisted by Claude Opus 5.5.
    
    v1: https://lore.kernel.org/linux-remoteproc/20261029130037.5505-1-izaiahsun@gmail.com/

 drivers/remoteproc/remoteproc_core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index d5fa9d23bd5c..d0b1f6ee49d3 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -2312,7 +2312,10 @@ int rproc_add(struct rproc *rproc)
 
 	ret = device_add(dev);
 	if (ret < 0) {
-		put_device(dev);
+		/*
+		 * Do not put_device() here: the caller's rproc_free() does
+		 * it, and the reference would be dropped twice.
+		 */
 		goto rproc_remove_cdev;
 	}
 

base-commit: b16b5a4fdf7d1f4ec15a53622d9b66081325fbf9
-- 
2.53.0

Re: [PATCH v2] remoteproc: core: Do not put the device when device_add() fails

[Francesco Valla]

On Fri, Nov 06, 2026 at 02:51:00PM +0800, Yuqiang Sun wrote:
> In rproc_add(), put_device() is called when device_add() fails.
> But st_slim_rproc_alloc(), xlnx_r5_remoteproc and the other 23
> drivers (which use devm_rproc_alloc() and so devm_rproc_free()) then
> call rproc_free(), which puts the device again. The reference is
> dropped twice, and st_slim_rproc_alloc() uses the rproc after it is
> freed.
> 
> Remove the put_device() in rproc_add() and add a comment saying why.
> 
> Fixes: 7dbdb8bd7c02 ("remoteproc: core: Cleanup device in case of failure")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yuqiang Sun <izaiahsun@gmail.com>
> ---
> 
> Notes:
>     Changes in v2:
>     - Comment in the device_add() failure branch (Mathieu).
>     - Shorter changelog.
>     - Rebased on rproc-next.
>     
>     Bug was found by kbound, an internal static analysis prototype.
>     The reproduction was assisted by Claude Opus 5.5.
>     
>     v1: https://lore.kernel.org/linux-remoteproc/20261029130037.5505-1-izaiahsun@gmail.com/
> 
>  drivers/remoteproc/remoteproc_core.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
> index d5fa9d23bd5c..d0b1f6ee49d3 100644
> --- a/drivers/remoteproc/remoteproc_core.c
> +++ b/drivers/remoteproc/remoteproc_core.c
> @@ -2312,7 +2312,10 @@ int rproc_add(struct rproc *rproc)
>  
>  	ret = device_add(dev);
>  	if (ret < 0) {
> -		put_device(dev);
> +		/*
> +		 * Do not put_device() here: the caller's rproc_free() does
> +		 * it, and the reference would be dropped twice.
> +		 */
>  		goto rproc_remove_cdev;
>  	}
>  
> 
> base-commit: b16b5a4fdf7d1f4ec15a53622d9b66081325fbf9
> -- 
> 2.53.0
> 
>

Reviewed-by: Francesco Valla <francesco@valla.it>

Regards,
Francesco