[PATCH v2] remoteproc: core: Do not put the device when device_add() fails

[Yuqiang Sun]

In rproc_add(), put_device() is called when device_add() fails.
But st_slim_rproc_alloc(), xlnx_r5_remoteproc and the other 23
drivers (which use devm_rproc_alloc() and so devm_rproc_free()) then
call rproc_free(), which puts the device again. The reference is
dropped twice, and st_slim_rproc_alloc() uses the rproc after it is
freed.

Remove the put_device() in rproc_add() and add a comment saying why.

Fixes: 7dbdb8bd7c02 ("remoteproc: core: Cleanup device in case of failure")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yuqiang Sun <izaiahsun@xxxxxxxxx>
---

Notes:
    Changes in v2:
    - Comment in the device_add() failure branch (Mathieu).
    - Shorter changelog.
    - Rebased on rproc-next.
    
    Bug was found by kbound, an internal static analysis prototype.
    The reproduction was assisted by Claude Opus 5.5.
    
    v1: https://lore.kernel.org/linux-remoteproc/20261029130037.5505-1-izaiahsun@xxxxxxxxx/

 drivers/remoteproc/remoteproc_core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index d5fa9d23bd5c..d0b1f6ee49d3 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -2312,7 +2312,10 @@ int rproc_add(struct rproc *rproc)
 
 	ret = device_add(dev);
 	if (ret < 0) {
-		put_device(dev);
+		/*
+		 * Do not put_device() here: the caller's rproc_free() does
+		 * it, and the reference would be dropped twice.
+		 */
 		goto rproc_remove_cdev;
 	}
 

base-commit: b16b5a4fdf7d1f4ec15a53622d9b66081325fbf9
-- 
2.53.0