Re: [PATCH] chardev: fix consistent error handling in cdev_device_add

[Zhangfei Gao]

On Wed, 19 Nov 2025 at 18:15, Zhangfei Gao <zhangfei.gao@xxxxxxxxxx> wrote:
>
> Currently cdev_device_add has inconsistent error handling:
>
> - If device_add fails, it calls cdev_del(cdev)
> - If cdev_add fails, it only returns error without cleanup
>
> This creates a problem because cdev_set_parent(cdev, &dev->kobj)
> establishes a parent-child relationship.
> When callers use cdev_del(cdev) to clean up after cdev_add failure,
> it also decrements the dev's refcount due to the parent relationship,
> causing refcount mismatch.
>
> To unify error handling:
> - Set cdev->kobj.parent = NULL first to break the parent relationship
> - Then call cdev_del(cdev) for cleanup
>
> This ensures that in both error paths,
> the dev's refcount remains consistent and callers don't need
> special handling for different failure scenarios.
>
> Signed-off-by: Zhangfei Gao <zhangfei.gao@xxxxxxxxxx>
> ---
>  fs/char_dev.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/fs/char_dev.c b/fs/char_dev.c
> index c2ddb998f3c9..fef6ee1aba66 100644
> --- a/fs/char_dev.c
> +++ b/fs/char_dev.c
> @@ -549,8 +549,11 @@ int cdev_device_add(struct cdev *cdev, struct device *dev)
>                 cdev_set_parent(cdev, &dev->kobj);
>
>                 rc = cdev_add(cdev, dev->devt, 1);
> -               if (rc)
> +               if (rc) {
> +                       cdev->kobj.parent = NULL;
> +                       cdev_del(cdev);
>                         return rc;
> +               }
>         }
>
>         rc = device_add(dev);
> --
> 2.25.1
>

Any comments, Thanks