Patch "regulator: core: fix kobject release warning and memory leak in regulator_register()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    regulator: core: fix kobject release warning and memory leak in regulator_register()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     regulator-core-fix-kobject-release-warning-and-memor.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c5e5cd76b2f3244b38e02cb2a682f30202b31a39
Author: Zeng Heng <zengheng4@xxxxxxxxxx>
Date:   Wed Nov 16 15:43:39 2022 +0800

    regulator: core: fix kobject release warning and memory leak in regulator_register()
    
    [ Upstream commit 5f4b204b6b8153923d5be8002c5f7082985d153f ]
    
    Here is a warning report about lack of registered release()
    from kobject lib:
    
    Device '(null)' does not have a release() function, it is broken and must be fixed.
    WARNING: CPU: 0 PID: 48430 at drivers/base/core.c:2332 device_release+0x104/0x120
    Call Trace:
     kobject_put+0xdc/0x180
     put_device+0x1b/0x30
     regulator_register+0x651/0x1170
     devm_regulator_register+0x4f/0xb0
    
    When regulator_register() returns fail and directly goto `clean` symbol,
    rdev->dev has not registered release() function yet (which is registered
    by regulator_class in the following), so rdev needs to be freed manually.
    If rdev->dev.of_node is not NULL, which means the of_node has gotten by
    regulator_of_get_init_data(), it needs to call of_node_put() to avoid
    refcount leak.
    
    Otherwise, only calling put_device() would lead memory leak of rdev
    in further:
    
    unreferenced object 0xffff88810d0b1000 (size 2048):
      comm "107-i2c-rtq6752", pid 48430, jiffies 4342258431 (age 1341.780s)
      backtrace:
        kmalloc_trace+0x22/0x110
        regulator_register+0x184/0x1170
        devm_regulator_register+0x4f/0xb0
    
    When regulator_register() returns fail and goto `wash` symbol,
    rdev->dev has registered release() function, so directly call
    put_device() to cleanup everything.
    
    Fixes: d3c731564e09 ("regulator: plug of_node leak in regulator_register()'s error path")
    Signed-off-by: Zeng Heng <zengheng4@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20221116074339.1024240-1-zengheng4@xxxxxxxxxx
    Signed-off-by: Mark Brown <broonie@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index aa4d78b02483..fd61c5c54a07 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -5549,11 +5549,15 @@ regulator_register(const struct regulator_desc *regulator_desc,
 	mutex_lock(&regulator_list_mutex);
 	regulator_ena_gpio_free(rdev);
 	mutex_unlock(&regulator_list_mutex);
+	put_device(&rdev->dev);
+	rdev = NULL;
 clean:
 	if (dangling_of_gpiod)
 		gpiod_put(config->ena_gpiod);
+	if (rdev && rdev->dev.of_node)
+		of_node_put(rdev->dev.of_node);
+	kfree(rdev);
 	kfree(config);
-	put_device(&rdev->dev);
 rinse:
 	if (dangling_cfg_gpiod)
 		gpiod_put(cfg->ena_gpiod);