Re: [PATCH v1] bus: mhi: ep: Fix device refcount leak on create failure

Manivannan Sadhasivam <[email protected]> Sat, 20 Jun 2026 21:34:15 +0530
Newsgroups dev.linux.lists.mhi,org.kernel.vger.linux-arm-msm,org.kernel.vger.linux-kernel
Message-ID <7fxkftqor7i2cfa24ihrafkqz7gspwzqj5q3xavakksrb7lcq6@y3br6tovcell>
On Wed, Jun 03, 2026 at 03:51:42PM -0400, Yuho Choi wrote:
> mhi_ep_create_device() takes one device reference for the UL channel and
> another for the DL channel after allocating the transfer device. These
> references are normally released by mhi_ep_destroy_device() before the
> device itself is removed.
> 
> If dev_set_name() or device_add() fails, the error path currently drops
> only one reference. The remaining channel references keep the device
> from being released and leave the channels associated with a device that
> was never registered.
> 
> Route both failures through a common unwind path that drops the DL
> channel reference, the UL channel reference, and the initial reference
> from device_initialize().
> 
> Fixes: 297c77a0f273 ("bus: mhi: ep: Add support for creating and destroying MHI EP devices")
> Signed-off-by: Yuho Choi <[email protected]>

LGTM! But this patch can only be applied when v7.2-rc1 is released.

- Mani

> ---
>  drivers/bus/mhi/ep/main.c | 14 +++++++++-----
>  1 file changed, 9 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c
> index 0277e1ab1198..34d3662eb091 100644
> --- a/drivers/bus/mhi/ep/main.c
> +++ b/drivers/bus/mhi/ep/main.c
> @@ -1338,15 +1338,19 @@ static int mhi_ep_create_device(struct mhi_ep_cntrl *mhi_cntrl, u32 ch_id)
>  	ret = dev_set_name(&mhi_dev->dev, "%s_%s",
>  		     dev_name(&mhi_cntrl->mhi_dev->dev),
>  		     mhi_dev->name);
> -	if (ret) {
> -		put_device(&mhi_dev->dev);
> -		return ret;
> -	}
> +	if (ret)
> +		goto err_put_channels;
>  
>  	ret = device_add(&mhi_dev->dev);
>  	if (ret)
> -		put_device(&mhi_dev->dev);
> +		goto err_put_channels;
> +
> +	return 0;
>  
> +err_put_channels:
> +	put_device(&mhi_dev->dev); /* DL channel reference */
> +	put_device(&mhi_dev->dev); /* UL channel reference */
> +	put_device(&mhi_dev->dev); /* device_initialize() reference */
>  	return ret;
>  }
>  
> -- 
> 2.43.0
> 

-- 
மணிவண்ணன் சதாசிவம்