[PATCH] platform/chrome: wilco_ec: Fix device reference leak on open failure

[PATCH] platform/chrome: wilco_ec: Fix device reference leak on open failure

[Yige Jiang]

telem_open() takes a reference to dev_data->dev before allocating
the session. If that allocation fails, it returns -ENOMEM without
dropping the reference. Since release is not called after a failed
open, the device data remains pinned after removal.

Drop the reference on the allocation failure path, after restoring
the available flag. Keeping the put after that final access avoids
touching dev_data if the put invokes telem_device_free().

Fixes: 1210d1e6bad1 ("platform/chrome: wilco_ec: Add telemetry char device interface")
Assisted-by: LLM
Signed-off-by: Yige Jiang <yigejiang86@gmail.com>
---
Based on linux-next next-20261102 (2637bdec0535).
Compile-tested: arm64, GCC 14.2.0, W=1, CONFIG_OF_DYNAMIC=y.
COMPILE_TEST=y.
Baseline and patched target objects built from this exact base.
No full kernel/module-link, hardware or runtime test was performed.
AI assistance: Codex (LLM) for ownership analysis, code and changelog.

 drivers/platform/chrome/wilco_ec/telemetry.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/chrome/wilco_ec/telemetry.c b/drivers/platform/chrome/wilco_ec/telemetry.c
index 45be318b05f6..79fcc46e4417 100644
--- a/drivers/platform/chrome/wilco_ec/telemetry.c
+++ b/drivers/platform/chrome/wilco_ec/telemetry.c
@@ -250,6 +250,7 @@ static int telem_open(struct inode *inode, struct file *filp)
 	sess_data = kzalloc_obj(*sess_data);
 	if (!sess_data) {
 		atomic_set(&dev_data->available, 1);
+		put_device(&dev_data->dev);
 		return -ENOMEM;
 	}
 	sess_data->dev_data = dev_data;

base-commit: 2637bdec0535a2044cd830eba9a79363651d9043

Re: [PATCH] platform/chrome: wilco_ec: Fix device reference leak on open failure

[Tzung-Bi Shih]

On Thu, Nov 05, 2026 at 12:47:12PM +0800, Yige Jiang wrote:
> telem_open() takes a reference to dev_data->dev before allocating
> the session. If that allocation fails, it returns -ENOMEM without
> dropping the reference. Since release is not called after a failed
> open, the device data remains pinned after removal.
> 
> Drop the reference on the allocation failure path, after restoring

Moving get_device() after kzalloc_obj() succeeds makes it cleaner.

> Assisted-by: LLM

The tag is no longer used; ./scripts/checkpatch.pl --strict:
WARNING: Non-standard signature: Assisted-by:
ERROR: Unrecognized email address: 'LLM'