register_platform_devices() creates multiple platform devices using platform_device_register_data(), but returns directly when a later platform device registration fails. If LED or watchdog platform device registration fails, previously registered platform devices are left registered. Since module init failure does not invoke the module exit cleanup path, these platform devices remain allocated and their backing platform_object memory is leaked. Unregister successfully created platform devices on registration failure paths to restore the missing cleanup. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fixes: dd123e62bded ("platform/x86: simatic-ipc: add main driver for Siemens devices") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/platform/x86/siemens/simatic-ipc.c | 40 ++++++++++++++++++---- 1 file changed, 34 insertions(+), 6 deletions(-) diff --git a/drivers/platform/x86/siemens/simatic-ipc.c b/drivers/platform/x86/siemens/simatic-ipc.c index 7039874d8f11..9bf8b2d8248c 100644 --- a/drivers/platform/x86/siemens/simatic-ipc.c +++ b/drivers/platform/x86/siemens/simatic-ipc.c @@ -92,6 +92,7 @@ static int register_platform_devices(u32 station_id) u8 wdtmode = SIMATIC_IPC_DEVICE_NONE; u8 battmode = SIMATIC_IPC_DEVICE_NONE; char *pdevname; + int ret; int i; for (i = 0; i < ARRAY_SIZE(device_modes); i++) { @@ -118,8 +119,11 @@ static int register_platform_devices(u32 station_id) platform_device_register_data(NULL, pdevname, PLATFORM_DEVID_NONE, &platform_data, sizeof(struct simatic_ipc_platform)); - if (IS_ERR(ipc_batt_platform_device)) - return PTR_ERR(ipc_batt_platform_device); + if (IS_ERR(ipc_batt_platform_device)) { + ret = PTR_ERR(ipc_batt_platform_device); + ipc_batt_platform_device = NULL; + goto err_unregister; + } pr_debug("device=%s created\n", ipc_batt_platform_device->name); @@ -139,8 +143,11 @@ static int register_platform_devices(u32 station_id) pdevname, PLATFORM_DEVID_NONE, &platform_data, sizeof(struct simatic_ipc_platform)); - if (IS_ERR(ipc_led_platform_device)) - return PTR_ERR(ipc_led_platform_device); + if (IS_ERR(ipc_led_platform_device)) { + ret = PTR_ERR(ipc_led_platform_device); + ipc_led_platform_device = NULL; + goto err_unregister; + } pr_debug("device=%s created\n", ipc_led_platform_device->name); @@ -153,8 +160,11 @@ static int register_platform_devices(u32 station_id) KBUILD_MODNAME "_wdt", PLATFORM_DEVID_NONE, &platform_data, sizeof(struct simatic_ipc_platform)); - if (IS_ERR(ipc_wdt_platform_device)) - return PTR_ERR(ipc_wdt_platform_device); + if (IS_ERR(ipc_wdt_platform_device)) { + ret = PTR_ERR(ipc_wdt_platform_device); + ipc_wdt_platform_device = NULL; + goto err_unregister; + } pr_debug("device=%s created\n", ipc_wdt_platform_device->name); @@ -169,6 +179,24 @@ static int register_platform_devices(u32 station_id) } return 0; + +err_unregister: + if (ipc_wdt_platform_device) { + platform_device_unregister(ipc_wdt_platform_device); + ipc_wdt_platform_device = NULL; + } + + if (ipc_led_platform_device) { + platform_device_unregister(ipc_led_platform_device); + ipc_led_platform_device = NULL; + } + + if (ipc_batt_platform_device) { + platform_device_unregister(ipc_batt_platform_device); + ipc_batt_platform_device = NULL; + } + + return ret; } static void request_additional_modules(u32 station_id) -- 2.43.0