[PATCH] vfio/mdev: fix possible memory leak in module init funcs

[PATCH] vfio/mdev: fix possible memory leak in module init funcs

[ruanjinjie]

Inject fault while probing module, if device_register() fails,
but the refcount of kobject is not decreased to 0, the name
allocated in dev_set_name() is leaked. Fix this by calling
put_device(), so that name can be freed in callback function
kobject_cleanup().

unreferenced object 0xffff88807d687008 (size 8):
  comm "modprobe", pid 8280, jiffies 4294807686 (age 12.378s)
  hex dump (first 8 bytes):
    6d 64 70 79 00 6b 6b a5                          mdpy.kk.
  backtrace:
    [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150
    [<ffffffff81731d53>] kstrdup+0x33/0x60
    [<ffffffff83aa1421>] kobject_set_name_vargs+0x41/0x110
    [<ffffffff82d91abb>] dev_set_name+0xab/0xe0
    [<ffffffffa0260105>] 0xffffffffa0260105
    [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0
    [<ffffffff813739cb>] do_init_module+0x1ab/0x640
    [<ffffffff81379d20>] load_module+0x5d00/0x77f0
    [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0
    [<ffffffff83c944a5>] do_syscall_64+0x35/0x80
    [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

unreferenced object 0xffff888101ccbcf8 (size 8):
  comm "modprobe", pid 15662, jiffies 4295164481 (age 13.282s)
  hex dump (first 8 bytes):
    6d 74 74 79 00 6b 6b a5                          mtty.kk.
  backtrace:
    [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150
    [<ffffffff81731d53>] kstrdup+0x33/0x60
    [<ffffffff83aa1421>] kobject_set_name_vargs+0x41/0x110
    [<ffffffff82d91abb>] dev_set_name+0xab/0xe0
    [<ffffffffa0248134>] 0xffffffffa0248134
    [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0
    [<ffffffff813739cb>] do_init_module+0x1ab/0x640
    [<ffffffff81379d20>] load_module+0x5d00/0x77f0
    [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0
    [<ffffffff83c944a5>] do_syscall_64+0x35/0x80
    [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

unreferenced object 0xffff88810177c6c8 (size 8):
  comm "modprobe", pid 23657, jiffies 4295314656 (age 13.227s)
  hex dump (first 8 bytes):
    6d 62 6f 63 68 73 00 a5                          mbochs..
  backtrace:
    [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150
    [<ffffffff81731d53>] kstrdup+0x33/0x60
    [<ffffffff83aa1421>] kobject_set_name_vargs+0x41/0x110
    [<ffffffff82d91abb>] dev_set_name+0xab/0xe0
    [<ffffffffa0248124>] 0xffffffffa0248124
    [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0
    [<ffffffff813739cb>] do_init_module+0x1ab/0x640
    [<ffffffff81379d20>] load_module+0x5d00/0x77f0
    [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0
    [<ffffffff83c944a5>] do_syscall_64+0x35/0x80
    [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

Fixes: d61fc96f47fd ("sample: vfio mdev display - host device")
Fixes: 9d1a546c53b4 ("docs: Sample driver to demonstrate how to use Mediated device framework.")
Fixes: a5e6e6505f38 ("sample: vfio bochs vbe display (host device for bochs-drm)")
Signed-off-by: ruanjinjie <ruanjinjie@huawei.com>
---
 samples/vfio-mdev/mbochs.c | 4 +++-
 samples/vfio-mdev/mdpy.c   | 4 +++-
 samples/vfio-mdev/mtty.c   | 4 +++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/samples/vfio-mdev/mbochs.c b/samples/vfio-mdev/mbochs.c
index 117a8d799f71..1c47672be815 100644
--- a/samples/vfio-mdev/mbochs.c
+++ b/samples/vfio-mdev/mbochs.c
@@ -1430,8 +1430,10 @@ static int __init mbochs_dev_init(void)
 	dev_set_name(&mbochs_dev, "%s", MBOCHS_NAME);
 
 	ret = device_register(&mbochs_dev);
-	if (ret)
+	if (ret) {
+		put_device(&mbochs_dev);
 		goto err_class;
+	}
 
 	ret = mdev_register_parent(&mbochs_parent, &mbochs_dev, &mbochs_driver,
 				   mbochs_mdev_types,
diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
index 946e8cfde6fd..bfb93eaf535b 100644
--- a/samples/vfio-mdev/mdpy.c
+++ b/samples/vfio-mdev/mdpy.c
@@ -717,8 +717,10 @@ static int __init mdpy_dev_init(void)
 	dev_set_name(&mdpy_dev, "%s", MDPY_NAME);
 
 	ret = device_register(&mdpy_dev);
-	if (ret)
+	if (ret) {
+		put_device(&mdpy_dev);
 		goto err_class;
+	}
 
 	ret = mdev_register_parent(&mdpy_parent, &mdpy_dev, &mdpy_driver,
 				   mdpy_mdev_types,
diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
index e72085fc1376..dddb0619846c 100644
--- a/samples/vfio-mdev/mtty.c
+++ b/samples/vfio-mdev/mtty.c
@@ -1330,8 +1330,10 @@ static int __init mtty_dev_init(void)
 	dev_set_name(&mtty_dev.dev, "%s", MTTY_NAME);
 
 	ret = device_register(&mtty_dev.dev);
-	if (ret)
+	if (ret) {
+		put_device(&mtty_dev.dev);
 		goto err_class;
+	}
 
 	ret = mdev_register_parent(&mtty_dev.parent, &mtty_dev.dev,
 				   &mtty_driver, mtty_mdev_types,
-- 
2.25.1

Re: [PATCH] vfio/mdev: fix possible memory leak in module init funcs

[Ruan Jinjie]

Ping.

On 2022/11/18 11:28, ruanjinjie wrote:
> Inject fault while probing module, if device_register() fails,
> but the refcount of kobject is not decreased to 0, the name
> allocated in dev_set_name() is leaked. Fix this by calling
> put_device(), so that name can be freed in callback function
> kobject_cleanup().
> 
> unreferenced object 0xffff88807d687008 (size 8):
>   comm "modprobe", pid 8280, jiffies 4294807686 (age 12.378s)
>   hex dump (first 8 bytes):
>     6d 64 70 79 00 6b 6b a5                          mdpy.kk.
>   backtrace:
>     [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150
>     [<ffffffff81731d53>] kstrdup+0x33/0x60
>     [<ffffffff83aa1421>] kobject_set_name_vargs+0x41/0x110
>     [<ffffffff82d91abb>] dev_set_name+0xab/0xe0
>     [<ffffffffa0260105>] 0xffffffffa0260105
>     [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0
>     [<ffffffff813739cb>] do_init_module+0x1ab/0x640
>     [<ffffffff81379d20>] load_module+0x5d00/0x77f0
>     [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0
>     [<ffffffff83c944a5>] do_syscall_64+0x35/0x80
>     [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
> 
> unreferenced object 0xffff888101ccbcf8 (size 8):
>   comm "modprobe", pid 15662, jiffies 4295164481 (age 13.282s)
>   hex dump (first 8 bytes):
>     6d 74 74 79 00 6b 6b a5                          mtty.kk.
>   backtrace:
>     [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150
>     [<ffffffff81731d53>] kstrdup+0x33/0x60
>     [<ffffffff83aa1421>] kobject_set_name_vargs+0x41/0x110
>     [<ffffffff82d91abb>] dev_set_name+0xab/0xe0
>     [<ffffffffa0248134>] 0xffffffffa0248134
>     [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0
>     [<ffffffff813739cb>] do_init_module+0x1ab/0x640
>     [<ffffffff81379d20>] load_module+0x5d00/0x77f0
>     [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0
>     [<ffffffff83c944a5>] do_syscall_64+0x35/0x80
>     [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
> 
> unreferenced object 0xffff88810177c6c8 (size 8):
>   comm "modprobe", pid 23657, jiffies 4295314656 (age 13.227s)
>   hex dump (first 8 bytes):
>     6d 62 6f 63 68 73 00 a5                          mbochs..
>   backtrace:
>     [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150
>     [<ffffffff81731d53>] kstrdup+0x33/0x60
>     [<ffffffff83aa1421>] kobject_set_name_vargs+0x41/0x110
>     [<ffffffff82d91abb>] dev_set_name+0xab/0xe0
>     [<ffffffffa0248124>] 0xffffffffa0248124
>     [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0
>     [<ffffffff813739cb>] do_init_module+0x1ab/0x640
>     [<ffffffff81379d20>] load_module+0x5d00/0x77f0
>     [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0
>     [<ffffffff83c944a5>] do_syscall_64+0x35/0x80
>     [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
> 
> Fixes: d61fc96f47fd ("sample: vfio mdev display - host device")
> Fixes: 9d1a546c53b4 ("docs: Sample driver to demonstrate how to use Mediated device framework.")
> Fixes: a5e6e6505f38 ("sample: vfio bochs vbe display (host device for bochs-drm)")
> Signed-off-by: ruanjinjie <ruanjinjie@huawei.com>
> ---
>  samples/vfio-mdev/mbochs.c | 4 +++-
>  samples/vfio-mdev/mdpy.c   | 4 +++-
>  samples/vfio-mdev/mtty.c   | 4 +++-
>  3 files changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/samples/vfio-mdev/mbochs.c b/samples/vfio-mdev/mbochs.c
> index 117a8d799f71..1c47672be815 100644
> --- a/samples/vfio-mdev/mbochs.c
> +++ b/samples/vfio-mdev/mbochs.c
> @@ -1430,8 +1430,10 @@ static int __init mbochs_dev_init(void)
>  	dev_set_name(&mbochs_dev, "%s", MBOCHS_NAME);
>  
>  	ret = device_register(&mbochs_dev);
> -	if (ret)
> +	if (ret) {
> +		put_device(&mbochs_dev);
>  		goto err_class;
> +	}
>  
>  	ret = mdev_register_parent(&mbochs_parent, &mbochs_dev, &mbochs_driver,
>  				   mbochs_mdev_types,
> diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
> index 946e8cfde6fd..bfb93eaf535b 100644
> --- a/samples/vfio-mdev/mdpy.c
> +++ b/samples/vfio-mdev/mdpy.c
> @@ -717,8 +717,10 @@ static int __init mdpy_dev_init(void)
>  	dev_set_name(&mdpy_dev, "%s", MDPY_NAME);
>  
>  	ret = device_register(&mdpy_dev);
> -	if (ret)
> +	if (ret) {
> +		put_device(&mdpy_dev);
>  		goto err_class;
> +	}
>  
>  	ret = mdev_register_parent(&mdpy_parent, &mdpy_dev, &mdpy_driver,
>  				   mdpy_mdev_types,
> diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
> index e72085fc1376..dddb0619846c 100644
> --- a/samples/vfio-mdev/mtty.c
> +++ b/samples/vfio-mdev/mtty.c
> @@ -1330,8 +1330,10 @@ static int __init mtty_dev_init(void)
>  	dev_set_name(&mtty_dev.dev, "%s", MTTY_NAME);
>  
>  	ret = device_register(&mtty_dev.dev);
> -	if (ret)
> +	if (ret) {
> +		put_device(&mtty_dev.dev);
>  		goto err_class;
> +	}
>  
>  	ret = mdev_register_parent(&mtty_dev.parent, &mtty_dev.dev,
>  				   &mtty_driver, mtty_mdev_types,

Re: [PATCH] vfio/mdev: fix possible memory leak in module init funcs

[Alex Williamson]

[Cc +vfio-ap, vfio-ccw]

On Fri, 18 Nov 2022 11:28:27 +0800
ruanjinjie <ruanjinjie@huawei.com> wrote:

> Inject fault while probing module, if device_register() fails,
> but the refcount of kobject is not decreased to 0, the name
> allocated in dev_set_name() is leaked. Fix this by calling
> put_device(), so that name can be freed in callback function
> kobject_cleanup().
> 
> unreferenced object 0xffff88807d687008 (size 8):
>   comm "modprobe", pid 8280, jiffies 4294807686 (age 12.378s)
>   hex dump (first 8 bytes):
>     6d 64 70 79 00 6b 6b a5                          mdpy.kk.
>   backtrace:
>     [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150
>     [<ffffffff81731d53>] kstrdup+0x33/0x60
>     [<ffffffff83aa1421>] kobject_set_name_vargs+0x41/0x110
>     [<ffffffff82d91abb>] dev_set_name+0xab/0xe0
>     [<ffffffffa0260105>] 0xffffffffa0260105
>     [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0
>     [<ffffffff813739cb>] do_init_module+0x1ab/0x640
>     [<ffffffff81379d20>] load_module+0x5d00/0x77f0
>     [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0
>     [<ffffffff83c944a5>] do_syscall_64+0x35/0x80
>     [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
> 
> unreferenced object 0xffff888101ccbcf8 (size 8):
>   comm "modprobe", pid 15662, jiffies 4295164481 (age 13.282s)
>   hex dump (first 8 bytes):
>     6d 74 74 79 00 6b 6b a5                          mtty.kk.
>   backtrace:
>     [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150
>     [<ffffffff81731d53>] kstrdup+0x33/0x60
>     [<ffffffff83aa1421>] kobject_set_name_vargs+0x41/0x110
>     [<ffffffff82d91abb>] dev_set_name+0xab/0xe0
>     [<ffffffffa0248134>] 0xffffffffa0248134
>     [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0
>     [<ffffffff813739cb>] do_init_module+0x1ab/0x640
>     [<ffffffff81379d20>] load_module+0x5d00/0x77f0
>     [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0
>     [<ffffffff83c944a5>] do_syscall_64+0x35/0x80
>     [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
> 
> unreferenced object 0xffff88810177c6c8 (size 8):
>   comm "modprobe", pid 23657, jiffies 4295314656 (age 13.227s)
>   hex dump (first 8 bytes):
>     6d 62 6f 63 68 73 00 a5                          mbochs..
>   backtrace:
>     [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150
>     [<ffffffff81731d53>] kstrdup+0x33/0x60
>     [<ffffffff83aa1421>] kobject_set_name_vargs+0x41/0x110
>     [<ffffffff82d91abb>] dev_set_name+0xab/0xe0
>     [<ffffffffa0248124>] 0xffffffffa0248124
>     [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0
>     [<ffffffff813739cb>] do_init_module+0x1ab/0x640
>     [<ffffffff81379d20>] load_module+0x5d00/0x77f0
>     [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0
>     [<ffffffff83c944a5>] do_syscall_64+0x35/0x80
>     [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
> 
> Fixes: d61fc96f47fd ("sample: vfio mdev display - host device")
> Fixes: 9d1a546c53b4 ("docs: Sample driver to demonstrate how to use Mediated device framework.")
> Fixes: a5e6e6505f38 ("sample: vfio bochs vbe display (host device for bochs-drm)")
> Signed-off-by: ruanjinjie <ruanjinjie@huawei.com>
> ---
>  samples/vfio-mdev/mbochs.c | 4 +++-
>  samples/vfio-mdev/mdpy.c   | 4 +++-
>  samples/vfio-mdev/mtty.c   | 4 +++-
>  3 files changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/samples/vfio-mdev/mbochs.c b/samples/vfio-mdev/mbochs.c
> index 117a8d799f71..1c47672be815 100644
> --- a/samples/vfio-mdev/mbochs.c
> +++ b/samples/vfio-mdev/mbochs.c
> @@ -1430,8 +1430,10 @@ static int __init mbochs_dev_init(void)
>  	dev_set_name(&mbochs_dev, "%s", MBOCHS_NAME);
>  
>  	ret = device_register(&mbochs_dev);
> -	if (ret)
> +	if (ret) {
> +		put_device(&mbochs_dev);
>  		goto err_class;
> +	}
>  
>  	ret = mdev_register_parent(&mbochs_parent, &mbochs_dev, &mbochs_driver,
>  				   mbochs_mdev_types,


vfio-ap has a similar unwind as the sample drivers, but actually makes
an attempt to catch this ex:

	...
        ret = device_register(&matrix_dev->device);
        if (ret)
                goto matrix_reg_err;

        ret = driver_register(&matrix_driver);
        if (ret)
                goto matrix_drv_err;

        return 0;

matrix_drv_err:
        device_unregister(&matrix_dev->device);
matrix_reg_err:
        put_device(&matrix_dev->device);
	...

So of the vfio drivers calling device_register(), vfio-ap is the only
one that does a put_device() if device_register() fails, but it also
seems sketchy to call both device_unregister() and put_device() in the
case that we exit via matrix_drv_err.

I wonder if all of these shouldn't adopt a flow like:

	ret = device_register(&dev);
	if (ret)
		goto err1;

	....

	return 0;

err2:
	device_del(&dev);
err1:
	put_device(&dev);

Thanks,

Alex

> diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
> index 946e8cfde6fd..bfb93eaf535b 100644
> --- a/samples/vfio-mdev/mdpy.c
> +++ b/samples/vfio-mdev/mdpy.c
> @@ -717,8 +717,10 @@ static int __init mdpy_dev_init(void)
>  	dev_set_name(&mdpy_dev, "%s", MDPY_NAME);
>  
>  	ret = device_register(&mdpy_dev);
> -	if (ret)
> +	if (ret) {
> +		put_device(&mdpy_dev);
>  		goto err_class;
> +	}
>  
>  	ret = mdev_register_parent(&mdpy_parent, &mdpy_dev, &mdpy_driver,
>  				   mdpy_mdev_types,
> diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
> index e72085fc1376..dddb0619846c 100644
> --- a/samples/vfio-mdev/mtty.c
> +++ b/samples/vfio-mdev/mtty.c
> @@ -1330,8 +1330,10 @@ static int __init mtty_dev_init(void)
>  	dev_set_name(&mtty_dev.dev, "%s", MTTY_NAME);
>  
>  	ret = device_register(&mtty_dev.dev);
> -	if (ret)
> +	if (ret) {
> +		put_device(&mtty_dev.dev);
>  		goto err_class;
> +	}
>  
>  	ret = mdev_register_parent(&mtty_dev.parent, &mtty_dev.dev,
>  				   &mtty_driver, mtty_mdev_types,

RE: [PATCH] vfio/mdev: fix possible memory leak in module init funcs

[Tian, Kevin]

> From: Alex Williamson <alex.williamson@redhat.com>
> Sent: Thursday, December 1, 2022 7:06 AM
> 
> [Cc +vfio-ap, vfio-ccw]
> 
> On Fri, 18 Nov 2022 11:28:27 +0800
> ruanjinjie <ruanjinjie@huawei.com> wrote:
> 
> > Inject fault while probing module, if device_register() fails,
> > but the refcount of kobject is not decreased to 0, the name
> > allocated in dev_set_name() is leaked. Fix this by calling
> > put_device(), so that name can be freed in callback function
> > kobject_cleanup().

It's not just about the name. The problem of kboject not being
released is a bigger one.

put_device() is always required no matter device_register()
succeeds or not:

* NOTE: _Never_ directly free @dev after calling this function, even
 * if it returned an error! Always use put_device() to give up the
 * reference initialized in this function instead.
 */
int device_register(struct device *dev)

> > @@ -1430,8 +1430,10 @@ static int __init mbochs_dev_init(void)
> >  	dev_set_name(&mbochs_dev, "%s", MBOCHS_NAME);
> >
> >  	ret = device_register(&mbochs_dev);
> > -	if (ret)
> > +	if (ret) {
> > +		put_device(&mbochs_dev);
> >  		goto err_class;
> > +	}
> >
> >  	ret = mdev_register_parent(&mbochs_parent, &mbochs_dev,
> &mbochs_driver,
> >  				   mbochs_mdev_types,
> 
> 
> vfio-ap has a similar unwind as the sample drivers, but actually makes
> an attempt to catch this ex:
> 
> 	...
>         ret = device_register(&matrix_dev->device);
>         if (ret)
>                 goto matrix_reg_err;
> 
>         ret = driver_register(&matrix_driver);
>         if (ret)
>                 goto matrix_drv_err;
> 
>         return 0;
> 
> matrix_drv_err:
>         device_unregister(&matrix_dev->device);
> matrix_reg_err:
>         put_device(&matrix_dev->device);
> 	...
> 
> So of the vfio drivers calling device_register(), vfio-ap is the only
> one that does a put_device() if device_register() fails, but it also
> seems sketchy to call both device_unregister() and put_device() in the
> case that we exit via matrix_drv_err.
> 
> I wonder if all of these shouldn't adopt a flow like:
> 
> 	ret = device_register(&dev);
> 	if (ret)
> 		goto err1;
> 
> 	....
> 
> 	return 0;
> 
> err2:
> 	device_del(&dev);
> err1:
> 	put_device(&dev);
> 

It's kind of a mixed model.

With above unwind it's clearer to use device_initialize() and device_add() instead.

Otherwise what this patch does looks better IMHO:

	ret = device_register(&dev);
	if (ret) {
		put_device(&dev);
		goto err1;
	}

	...

	return 0;

err2:
	device_unregister(&dev);
err1:
	earlier_unwind();

Re: [PATCH] vfio/mdev: fix possible memory leak in module init funcs

[Ruan Jinjie]

On 2022/12/1 7:06, Alex Williamson wrote:
> [Cc +vfio-ap, vfio-ccw]
> 
> On Fri, 18 Nov 2022 11:28:27 +0800
> ruanjinjie <ruanjinjie@huawei.com> wrote:
> 
>> Inject fault while probing module, if device_register() fails,
>> but the refcount of kobject is not decreased to 0, the name
>> allocated in dev_set_name() is leaked. Fix this by calling
>> put_device(), so that name can be freed in callback function
>> kobject_cleanup().
>>
>> unreferenced object 0xffff88807d687008 (size 8):
>>   comm "modprobe", pid 8280, jiffies 4294807686 (age 12.378s)
>>   hex dump (first 8 bytes):
>>     6d 64 70 79 00 6b 6b a5                          mdpy.kk.
>>   backtrace:
>>     [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150
>>     [<ffffffff81731d53>] kstrdup+0x33/0x60
>>     [<ffffffff83aa1421>] kobject_set_name_vargs+0x41/0x110
>>     [<ffffffff82d91abb>] dev_set_name+0xab/0xe0
>>     [<ffffffffa0260105>] 0xffffffffa0260105
>>     [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0
>>     [<ffffffff813739cb>] do_init_module+0x1ab/0x640
>>     [<ffffffff81379d20>] load_module+0x5d00/0x77f0
>>     [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0
>>     [<ffffffff83c944a5>] do_syscall_64+0x35/0x80
>>     [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
>>
>> unreferenced object 0xffff888101ccbcf8 (size 8):
>>   comm "modprobe", pid 15662, jiffies 4295164481 (age 13.282s)
>>   hex dump (first 8 bytes):
>>     6d 74 74 79 00 6b 6b a5                          mtty.kk.
>>   backtrace:
>>     [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150
>>     [<ffffffff81731d53>] kstrdup+0x33/0x60
>>     [<ffffffff83aa1421>] kobject_set_name_vargs+0x41/0x110
>>     [<ffffffff82d91abb>] dev_set_name+0xab/0xe0
>>     [<ffffffffa0248134>] 0xffffffffa0248134
>>     [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0
>>     [<ffffffff813739cb>] do_init_module+0x1ab/0x640
>>     [<ffffffff81379d20>] load_module+0x5d00/0x77f0
>>     [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0
>>     [<ffffffff83c944a5>] do_syscall_64+0x35/0x80
>>     [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
>>
>> unreferenced object 0xffff88810177c6c8 (size 8):
>>   comm "modprobe", pid 23657, jiffies 4295314656 (age 13.227s)
>>   hex dump (first 8 bytes):
>>     6d 62 6f 63 68 73 00 a5                          mbochs..
>>   backtrace:
>>     [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150
>>     [<ffffffff81731d53>] kstrdup+0x33/0x60
>>     [<ffffffff83aa1421>] kobject_set_name_vargs+0x41/0x110
>>     [<ffffffff82d91abb>] dev_set_name+0xab/0xe0
>>     [<ffffffffa0248124>] 0xffffffffa0248124
>>     [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0
>>     [<ffffffff813739cb>] do_init_module+0x1ab/0x640
>>     [<ffffffff81379d20>] load_module+0x5d00/0x77f0
>>     [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0
>>     [<ffffffff83c944a5>] do_syscall_64+0x35/0x80
>>     [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
>>
>> Fixes: d61fc96f47fd ("sample: vfio mdev display - host device")
>> Fixes: 9d1a546c53b4 ("docs: Sample driver to demonstrate how to use Mediated device framework.")
>> Fixes: a5e6e6505f38 ("sample: vfio bochs vbe display (host device for bochs-drm)")
>> Signed-off-by: ruanjinjie <ruanjinjie@huawei.com>
>> ---
>>  samples/vfio-mdev/mbochs.c | 4 +++-
>>  samples/vfio-mdev/mdpy.c   | 4 +++-
>>  samples/vfio-mdev/mtty.c   | 4 +++-
>>  3 files changed, 9 insertions(+), 3 deletions(-)
>>
>> diff --git a/samples/vfio-mdev/mbochs.c b/samples/vfio-mdev/mbochs.c
>> index 117a8d799f71..1c47672be815 100644
>> --- a/samples/vfio-mdev/mbochs.c
>> +++ b/samples/vfio-mdev/mbochs.c
>> @@ -1430,8 +1430,10 @@ static int __init mbochs_dev_init(void)
>>  	dev_set_name(&mbochs_dev, "%s", MBOCHS_NAME);
>>  
>>  	ret = device_register(&mbochs_dev);
>> -	if (ret)
>> +	if (ret) {
>> +		put_device(&mbochs_dev);
>>  		goto err_class;
>> +	}
>>  
>>  	ret = mdev_register_parent(&mbochs_parent, &mbochs_dev, &mbochs_driver,
>>  				   mbochs_mdev_types,
> 
> 
> vfio-ap has a similar unwind as the sample drivers, but actually makes
> an attempt to catch this ex:
I think the reason is vfio-ap driver error path has common unwind to do
before device_register, otherwise it can return just after put_device or
device_unregister.
> 
> 	...
>         ret = device_register(&matrix_dev->device);
>         if (ret)
>                 goto matrix_reg_err;
> 
>         ret = driver_register(&matrix_driver);
>         if (ret)
>                 goto matrix_drv_err;
> 
>         return 0;
> 
> matrix_drv_err:
>         device_unregister(&matrix_dev->device);
> matrix_reg_err:
>         put_device(&matrix_dev->device);
> 	...
> 
> So of the vfio drivers calling device_register(), vfio-ap is the only
> one that does a put_device() if device_register() fails, but it also
> seems sketchy to call both device_unregister() and put_device() in the
> case that we exit via matrix_drv_err.
The patch do not change the original error path, just add missing
put_device out of the normal error path if device_register fails , so
there is no risk of calling both device_unregister() and put_device().
> 
> I wonder if all of these shouldn't adopt a flow like:
> 
> 	ret = device_register(&dev);
> 	if (ret)
> 		goto err1;
> 
> 	....
> 
> 	return 0;
> 
> err2:
> 	device_del(&dev);
> err1:
> 	put_device(&dev);
> 
> Thanks,
> 
> Alex
> 
>> diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
>> index 946e8cfde6fd..bfb93eaf535b 100644
>> --- a/samples/vfio-mdev/mdpy.c
>> +++ b/samples/vfio-mdev/mdpy.c
>> @@ -717,8 +717,10 @@ static int __init mdpy_dev_init(void)
>>  	dev_set_name(&mdpy_dev, "%s", MDPY_NAME);
>>  
>>  	ret = device_register(&mdpy_dev);
>> -	if (ret)
>> +	if (ret) {
>> +		put_device(&mdpy_dev);
>>  		goto err_class;
>> +	}
>>  
>>  	ret = mdev_register_parent(&mdpy_parent, &mdpy_dev, &mdpy_driver,
>>  				   mdpy_mdev_types,
>> diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
>> index e72085fc1376..dddb0619846c 100644
>> --- a/samples/vfio-mdev/mtty.c
>> +++ b/samples/vfio-mdev/mtty.c
>> @@ -1330,8 +1330,10 @@ static int __init mtty_dev_init(void)
>>  	dev_set_name(&mtty_dev.dev, "%s", MTTY_NAME);
>>  
>>  	ret = device_register(&mtty_dev.dev);
>> -	if (ret)
>> +	if (ret) {
>> +		put_device(&mtty_dev.dev);
>>  		goto err_class;
>> +	}
>>  
>>  	ret = mdev_register_parent(&mtty_dev.parent, &mtty_dev.dev,
>>  				   &mtty_driver, mtty_mdev_types,
> 

Re: [PATCH] vfio/mdev: fix possible memory leak in module init funcs

[Alex Williamson]

On Thu, 1 Dec 2022 02:00:57 +0000
"Tian, Kevin" <kevin.tian@intel.com> wrote:

> > From: Alex Williamson <alex.williamson@redhat.com>
> > Sent: Thursday, December 1, 2022 7:06 AM
> > 
> > [Cc +vfio-ap, vfio-ccw]
> > 
> > On Fri, 18 Nov 2022 11:28:27 +0800
> > ruanjinjie <ruanjinjie@huawei.com> wrote:
> >   
> > > Inject fault while probing module, if device_register() fails,
> > > but the refcount of kobject is not decreased to 0, the name
> > > allocated in dev_set_name() is leaked. Fix this by calling
> > > put_device(), so that name can be freed in callback function
> > > kobject_cleanup().  
> 
> It's not just about the name. The problem of kboject not being
> released is a bigger one.
> 
> put_device() is always required no matter device_register()
> succeeds or not:
> 
> * NOTE: _Never_ directly free @dev after calling this function, even
>  * if it returned an error! Always use put_device() to give up the
>  * reference initialized in this function instead.
>  */
> int device_register(struct device *dev)
> 
> > > @@ -1430,8 +1430,10 @@ static int __init mbochs_dev_init(void)
> > >  	dev_set_name(&mbochs_dev, "%s", MBOCHS_NAME);
> > >
> > >  	ret = device_register(&mbochs_dev);
> > > -	if (ret)
> > > +	if (ret) {
> > > +		put_device(&mbochs_dev);
> > >  		goto err_class;
> > > +	}
> > >
> > >  	ret = mdev_register_parent(&mbochs_parent, &mbochs_dev,  
> > &mbochs_driver,  
> > >  				   mbochs_mdev_types,  
> > 
> > 
> > vfio-ap has a similar unwind as the sample drivers, but actually makes
> > an attempt to catch this ex:
> > 
> > 	...
> >         ret = device_register(&matrix_dev->device);
> >         if (ret)
> >                 goto matrix_reg_err;
> > 
> >         ret = driver_register(&matrix_driver);
> >         if (ret)
> >                 goto matrix_drv_err;
> > 
> >         return 0;
> > 
> > matrix_drv_err:
> >         device_unregister(&matrix_dev->device);
> > matrix_reg_err:
> >         put_device(&matrix_dev->device);
> > 	...
> > 
> > So of the vfio drivers calling device_register(), vfio-ap is the only
> > one that does a put_device() if device_register() fails, but it also
> > seems sketchy to call both device_unregister() and put_device() in the
> > case that we exit via matrix_drv_err.
> > 
> > I wonder if all of these shouldn't adopt a flow like:
> > 
> > 	ret = device_register(&dev);
> > 	if (ret)
> > 		goto err1;
> > 
> > 	....
> > 
> > 	return 0;
> > 
> > err2:
> > 	device_del(&dev);
> > err1:
> > 	put_device(&dev);
> >   
> 
> It's kind of a mixed model.
> 
> With above unwind it's clearer to use device_initialize() and device_add() instead.

That would go against the comment for device_register() recommending
that device_initialize() and device_add() should only be called
separately if we have a clearly defined need.  I can only imagine a
patch bot would quickly come along to rectify the situation if we
simply open code device_register() for aesthetics.  I don't see that
splitting device_unregister() for the purpose of having a common unwind
path necessitates any changes relative to device_register().

> Otherwise what this patch does looks better IMHO:
> 
> 	ret = device_register(&dev);
> 	if (ret) {
> 		put_device(&dev);
> 		goto err1;
> 	}
> 
> 	...
> 
> 	return 0;
> 
> err2:
> 	device_unregister(&dev);
> err1:
> 	earlier_unwind();
> 

This is essentially what was originally proposed.  It could also be
called a "mixed model", implementing part of the unwind in the error
branch before jumping to the common unwind.  As demonstrated below,
every current vfio driver calling device_register() follows a similar
goto unwind stack as found in the sample drivers, which makes it
trivially easy to split the device_unregister() call and add a goto
target in between.

Either way, they're equivalent and I'll take whichever version
addresses all the vfio related use cases and gets acks from their
maintainers.  Thanks,

Alex

diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
index c2a65808605a..54aba7cceb33 100644
--- a/drivers/s390/cio/vfio_ccw_drv.c
+++ b/drivers/s390/cio/vfio_ccw_drv.c
@@ -199,8 +199,9 @@ static int vfio_ccw_sch_probe(struct subchannel *sch)
 	return 0;
 
 out_unreg:
-	device_unregister(&parent->dev);
+	device_del(&parent->dev);
 out_free:
+	put_device(&parent->dev);
 	dev_set_drvdata(&sch->dev, NULL);
 	return ret;
 }
diff --git a/drivers/s390/crypto/vfio_ap_drv.c b/drivers/s390/crypto/vfio_ap_drv.c
index f43cfeabd2cc..997b524bdd2b 100644
--- a/drivers/s390/crypto/vfio_ap_drv.c
+++ b/drivers/s390/crypto/vfio_ap_drv.c
@@ -122,7 +122,7 @@ static int vfio_ap_matrix_dev_create(void)
 	return 0;
 
 matrix_drv_err:
-	device_unregister(&matrix_dev->device);
+	device_del(&matrix_dev->device);
 matrix_reg_err:
 	put_device(&matrix_dev->device);
 matrix_alloc_err:
diff --git a/samples/vfio-mdev/mbochs.c b/samples/vfio-mdev/mbochs.c
index 8b5a3a778a25..e54eb752e1ba 100644
--- a/samples/vfio-mdev/mbochs.c
+++ b/samples/vfio-mdev/mbochs.c
@@ -1430,7 +1430,7 @@ static int __init mbochs_dev_init(void)
 
 	ret = device_register(&mbochs_dev);
 	if (ret)
-		goto err_class;
+		goto err_put;
 
 	ret = mdev_register_parent(&mbochs_parent, &mbochs_dev, &mbochs_driver,
 				   mbochs_mdev_types,
@@ -1441,8 +1441,9 @@ static int __init mbochs_dev_init(void)
 	return 0;
 
 err_device:
-	device_unregister(&mbochs_dev);
-err_class:
+	device_del(&mbochs_dev);
+err_put:
+	put_device(&mbochs_dev);
 	class_destroy(mbochs_class);
 err_driver:
 	mdev_unregister_driver(&mbochs_driver);
diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
index 721fb06c6413..e8400fdab71d 100644
--- a/samples/vfio-mdev/mdpy.c
+++ b/samples/vfio-mdev/mdpy.c
@@ -717,7 +717,7 @@ static int __init mdpy_dev_init(void)
 
 	ret = device_register(&mdpy_dev);
 	if (ret)
-		goto err_class;
+		goto err_put;
 
 	ret = mdev_register_parent(&mdpy_parent, &mdpy_dev, &mdpy_driver,
 				   mdpy_mdev_types,
@@ -728,8 +728,9 @@ static int __init mdpy_dev_init(void)
 	return 0;
 
 err_device:
-	device_unregister(&mdpy_dev);
-err_class:
+	device_del(&mdpy_dev);
+err_put:
+	put_device(&mdpy_dev);
 	class_destroy(mdpy_class);
 err_driver:
 	mdev_unregister_driver(&mdpy_driver);
diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
index 3c2a421b9b69..e887de672c52 100644
--- a/samples/vfio-mdev/mtty.c
+++ b/samples/vfio-mdev/mtty.c
@@ -1330,7 +1330,7 @@ static int __init mtty_dev_init(void)
 
 	ret = device_register(&mtty_dev.dev);
 	if (ret)
-		goto err_class;
+		goto err_put;
 
 	ret = mdev_register_parent(&mtty_dev.parent, &mtty_dev.dev,
 				   &mtty_driver, mtty_mdev_types,
@@ -1340,8 +1340,9 @@ static int __init mtty_dev_init(void)
 	return 0;
 
 err_device:
-	device_unregister(&mtty_dev.dev);
-err_class:
+	device_del(&mtty_dev.dev);
+err_put:
+	put_device(&mtty_dev.dev);
 	class_destroy(mtty_dev.vd_class);
 err_driver:
 	mdev_unregister_driver(&mtty_driver);

RE: [PATCH] vfio/mdev: fix possible memory leak in module init funcs

[Tian, Kevin]

> From: Alex Williamson <alex.williamson@redhat.com>
> Sent: Friday, December 2, 2022 5:10 AM
> 
> > Otherwise what this patch does looks better IMHO:
> >
> > 	ret = device_register(&dev);
> > 	if (ret) {
> > 		put_device(&dev);
> > 		goto err1;
> > 	}
> >
> > 	...
> >
> > 	return 0;
> >
> > err2:
> > 	device_unregister(&dev);
> > err1:
> > 	earlier_unwind();
> >
> 
> This is essentially what was originally proposed.  It could also be
> called a "mixed model", implementing part of the unwind in the error
> branch before jumping to the common unwind.  As demonstrated below,
> every current vfio driver calling device_register() follows a similar
> goto unwind stack as found in the sample drivers, which makes it
> trivially easy to split the device_unregister() call and add a goto
> target in between.

OK. Actually looking into other users of device_register() I can
see both schemes are used, so...

> 
> Either way, they're equivalent and I'll take whichever version
> addresses all the vfio related use cases and gets acks from their
> maintainers.  Thanks,

... agree either way is fine. Since your version fixes all vfio cases,
feel free to include:

Reviewed-by: Kevin Tian <kevin.tian@intel.com>

> 
> Alex
> 
> diff --git a/drivers/s390/cio/vfio_ccw_drv.c
> b/drivers/s390/cio/vfio_ccw_drv.c
> index c2a65808605a..54aba7cceb33 100644
> --- a/drivers/s390/cio/vfio_ccw_drv.c
> +++ b/drivers/s390/cio/vfio_ccw_drv.c
> @@ -199,8 +199,9 @@ static int vfio_ccw_sch_probe(struct subchannel *sch)
>  	return 0;
> 
>  out_unreg:
> -	device_unregister(&parent->dev);
> +	device_del(&parent->dev);
>  out_free:
> +	put_device(&parent->dev);
>  	dev_set_drvdata(&sch->dev, NULL);
>  	return ret;
>  }
> diff --git a/drivers/s390/crypto/vfio_ap_drv.c
> b/drivers/s390/crypto/vfio_ap_drv.c
> index f43cfeabd2cc..997b524bdd2b 100644
> --- a/drivers/s390/crypto/vfio_ap_drv.c
> +++ b/drivers/s390/crypto/vfio_ap_drv.c
> @@ -122,7 +122,7 @@ static int vfio_ap_matrix_dev_create(void)
>  	return 0;
> 
>  matrix_drv_err:
> -	device_unregister(&matrix_dev->device);
> +	device_del(&matrix_dev->device);
>  matrix_reg_err:
>  	put_device(&matrix_dev->device);
>  matrix_alloc_err:
> diff --git a/samples/vfio-mdev/mbochs.c b/samples/vfio-mdev/mbochs.c
> index 8b5a3a778a25..e54eb752e1ba 100644
> --- a/samples/vfio-mdev/mbochs.c
> +++ b/samples/vfio-mdev/mbochs.c
> @@ -1430,7 +1430,7 @@ static int __init mbochs_dev_init(void)
> 
>  	ret = device_register(&mbochs_dev);
>  	if (ret)
> -		goto err_class;
> +		goto err_put;
> 
>  	ret = mdev_register_parent(&mbochs_parent, &mbochs_dev,
> &mbochs_driver,
>  				   mbochs_mdev_types,
> @@ -1441,8 +1441,9 @@ static int __init mbochs_dev_init(void)
>  	return 0;
> 
>  err_device:
> -	device_unregister(&mbochs_dev);
> -err_class:
> +	device_del(&mbochs_dev);
> +err_put:
> +	put_device(&mbochs_dev);
>  	class_destroy(mbochs_class);
>  err_driver:
>  	mdev_unregister_driver(&mbochs_driver);
> diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
> index 721fb06c6413..e8400fdab71d 100644
> --- a/samples/vfio-mdev/mdpy.c
> +++ b/samples/vfio-mdev/mdpy.c
> @@ -717,7 +717,7 @@ static int __init mdpy_dev_init(void)
> 
>  	ret = device_register(&mdpy_dev);
>  	if (ret)
> -		goto err_class;
> +		goto err_put;
> 
>  	ret = mdev_register_parent(&mdpy_parent, &mdpy_dev,
> &mdpy_driver,
>  				   mdpy_mdev_types,
> @@ -728,8 +728,9 @@ static int __init mdpy_dev_init(void)
>  	return 0;
> 
>  err_device:
> -	device_unregister(&mdpy_dev);
> -err_class:
> +	device_del(&mdpy_dev);
> +err_put:
> +	put_device(&mdpy_dev);
>  	class_destroy(mdpy_class);
>  err_driver:
>  	mdev_unregister_driver(&mdpy_driver);
> diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
> index 3c2a421b9b69..e887de672c52 100644
> --- a/samples/vfio-mdev/mtty.c
> +++ b/samples/vfio-mdev/mtty.c
> @@ -1330,7 +1330,7 @@ static int __init mtty_dev_init(void)
> 
>  	ret = device_register(&mtty_dev.dev);
>  	if (ret)
> -		goto err_class;
> +		goto err_put;
> 
>  	ret = mdev_register_parent(&mtty_dev.parent, &mtty_dev.dev,
>  				   &mtty_driver, mtty_mdev_types,
> @@ -1340,8 +1340,9 @@ static int __init mtty_dev_init(void)
>  	return 0;
> 
>  err_device:
> -	device_unregister(&mtty_dev.dev);
> -err_class:
> +	device_del(&mtty_dev.dev);
> +err_put:
> +	put_device(&mtty_dev.dev);
>  	class_destroy(mtty_dev.vd_class);
>  err_driver:
>  	mdev_unregister_driver(&mtty_driver);

Re: [PATCH] vfio/mdev: fix possible memory leak in module init funcs

[Eric Farman]

On Fri, 2022-12-02 at 05:28 +0000, Tian, Kevin wrote:
> > From: Alex Williamson <alex.williamson@redhat.com>
> > Sent: Friday, December 2, 2022 5:10 AM
> > 
> > > Otherwise what this patch does looks better IMHO:
> > > 
> > >         ret = device_register(&dev);
> > >         if (ret) {
> > >                 put_device(&dev);
> > >                 goto err1;
> > >         }
> > > 
> > >         ...
> > > 
> > >         return 0;
> > > 
> > > err2:
> > >         device_unregister(&dev);
> > > err1:
> > >         earlier_unwind();
> > > 
> > 
> > This is essentially what was originally proposed.  It could also be
> > called a "mixed model", implementing part of the unwind in the
> > error
> > branch before jumping to the common unwind.  As demonstrated below,
> > every current vfio driver calling device_register() follows a
> > similar
> > goto unwind stack as found in the sample drivers, which makes it
> > trivially easy to split the device_unregister() call and add a goto
> > target in between.
> 
> OK. Actually looking into other users of device_register() I can
> see both schemes are used, so...
> 
> > 
> > Either way, they're equivalent and I'll take whichever version
> > addresses all the vfio related use cases and gets acks from their
> > maintainers.  Thanks,
> 
> ... agree either way is fine. Since your version fixes all vfio
> cases,
> feel free to include:
> 
> Reviewed-by: Kevin Tian <kevin.tian@intel.com>
> 
> > 
> > Alex
> > 
> > diff --git a/drivers/s390/cio/vfio_ccw_drv.c
> > b/drivers/s390/cio/vfio_ccw_drv.c
> > index c2a65808605a..54aba7cceb33 100644
> > --- a/drivers/s390/cio/vfio_ccw_drv.c
> > +++ b/drivers/s390/cio/vfio_ccw_drv.c
> > @@ -199,8 +199,9 @@ static int vfio_ccw_sch_probe(struct subchannel
> > *sch)
> >         return 0;
> > 
> >  out_unreg:
> > -       device_unregister(&parent->dev);
> > +       device_del(&parent->dev);
> >  out_free:
> > +       put_device(&parent->dev);
> >         dev_set_drvdata(&sch->dev, NULL);
> >         return ret;
> >  }

Ugh, sorry. I had this partially right at one point but missed this
scenario when fixing the parts I had wrong.

This is fine by me, thanks for the fixup:

Reviewed-by: Eric Farman <farman@linux.ibm.com>

> > diff --git a/drivers/s390/crypto/vfio_ap_drv.c
> > b/drivers/s390/crypto/vfio_ap_drv.c
> > index f43cfeabd2cc..997b524bdd2b 100644
> > --- a/drivers/s390/crypto/vfio_ap_drv.c
> > +++ b/drivers/s390/crypto/vfio_ap_drv.c
> > @@ -122,7 +122,7 @@ static int vfio_ap_matrix_dev_create(void)
> >         return 0;
> > 
> >  matrix_drv_err:
> > -       device_unregister(&matrix_dev->device);
> > +       device_del(&matrix_dev->device);
> >  matrix_reg_err:
> >         put_device(&matrix_dev->device);
> >  matrix_alloc_err:
> > diff --git a/samples/vfio-mdev/mbochs.c b/samples/vfio-
> > mdev/mbochs.c
> > index 8b5a3a778a25..e54eb752e1ba 100644
> > --- a/samples/vfio-mdev/mbochs.c
> > +++ b/samples/vfio-mdev/mbochs.c
> > @@ -1430,7 +1430,7 @@ static int __init mbochs_dev_init(void)
> > 
> >         ret = device_register(&mbochs_dev);
> >         if (ret)
> > -               goto err_class;
> > +               goto err_put;
> > 
> >         ret = mdev_register_parent(&mbochs_parent, &mbochs_dev,
> > &mbochs_driver,
> >                                    mbochs_mdev_types,
> > @@ -1441,8 +1441,9 @@ static int __init mbochs_dev_init(void)
> >         return 0;
> > 
> >  err_device:
> > -       device_unregister(&mbochs_dev);
> > -err_class:
> > +       device_del(&mbochs_dev);
> > +err_put:
> > +       put_device(&mbochs_dev);
> >         class_destroy(mbochs_class);
> >  err_driver:
> >         mdev_unregister_driver(&mbochs_driver);
> > diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
> > index 721fb06c6413..e8400fdab71d 100644
> > --- a/samples/vfio-mdev/mdpy.c
> > +++ b/samples/vfio-mdev/mdpy.c
> > @@ -717,7 +717,7 @@ static int __init mdpy_dev_init(void)
> > 
> >         ret = device_register(&mdpy_dev);
> >         if (ret)
> > -               goto err_class;
> > +               goto err_put;
> > 
> >         ret = mdev_register_parent(&mdpy_parent, &mdpy_dev,
> > &mdpy_driver,
> >                                    mdpy_mdev_types,
> > @@ -728,8 +728,9 @@ static int __init mdpy_dev_init(void)
> >         return 0;
> > 
> >  err_device:
> > -       device_unregister(&mdpy_dev);
> > -err_class:
> > +       device_del(&mdpy_dev);
> > +err_put:
> > +       put_device(&mdpy_dev);
> >         class_destroy(mdpy_class);
> >  err_driver:
> >         mdev_unregister_driver(&mdpy_driver);
> > diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
> > index 3c2a421b9b69..e887de672c52 100644
> > --- a/samples/vfio-mdev/mtty.c
> > +++ b/samples/vfio-mdev/mtty.c
> > @@ -1330,7 +1330,7 @@ static int __init mtty_dev_init(void)
> > 
> >         ret = device_register(&mtty_dev.dev);
> >         if (ret)
> > -               goto err_class;
> > +               goto err_put;
> > 
> >         ret = mdev_register_parent(&mtty_dev.parent, &mtty_dev.dev,
> >                                    &mtty_driver, mtty_mdev_types,
> > @@ -1340,8 +1340,9 @@ static int __init mtty_dev_init(void)
> >         return 0;
> > 
> >  err_device:
> > -       device_unregister(&mtty_dev.dev);
> > -err_class:
> > +       device_del(&mtty_dev.dev);
> > +err_put:
> > +       put_device(&mtty_dev.dev);
> >         class_destroy(mtty_dev.vd_class);
> >  err_driver:
> >         mdev_unregister_driver(&mtty_driver);
>