Re: [PATCH v3] gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path

[Mikko Perttunen]

On Monday, April 13, 2026 11:15 PM Guangshuo Li wrote:
> After device_initialize(), the embedded struct device in struct
> host1x_device should be released through the device core with
> put_device().
> 
> In host1x_device_add(), if host1x_device_parse_dt() fails, the current
> error path frees the object directly with kfree(device). That bypasses
> the normal device lifetime handling and leaks the reference held on the
> embedded struct device.
> 
> The issue was identified by a static analysis tool I developed and
> confirmed by manual review.
> 
> Fix this by using put_device() in the host1x_device_parse_dt() failure
> path.
> 
> Fixes: f4c5cf88fbd50 ("gpu: host1x: Provide a proper struct bus_type")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
> ---
> v3:
>   - note that the issue was identified by my static analysis tool
>   - and confirmed by manual review
> 
> v2:
>   - add Cc: stable@xxxxxxxxxxxxxxx
> 
>  drivers/gpu/host1x/bus.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
> index 63fe037c3b65..e3ac85848aec 100644
> --- a/drivers/gpu/host1x/bus.c
> +++ b/drivers/gpu/host1x/bus.c
> @@ -452,7 +452,7 @@ static int host1x_device_add(struct host1x *host1x,
>  
>  	err = host1x_device_parse_dt(device, driver);
>  	if (err < 0) {
> -		kfree(device);
> +		put_device(&device->dev);
>  		return err;
>  	}
>  
> -- 
> 2.43.0
> 
> 

Thanks!

Acked-by: Mikko Perttunen <mperttunen@xxxxxxxxxx>