The qm_get_qos_value() function calls bus_find_device_by_name() which
increases the device reference count, but fails to call put_device()
to balance the reference count and lead to a device reference leak.

Add put_device() calls in both the error path and success path to
properly balance the reference count.

Found via static analysis.

Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
---
 drivers/crypto/hisilicon/qm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
index a5b96adf2d1e..3b391a146635 100644
--- a/drivers/crypto/hisilicon/qm.c
+++ b/drivers/crypto/hisilicon/qm.c
@@ -3871,10 +3871,12 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf,
 	pdev = container_of(dev, struct pci_dev, dev);
 	if (pci_physfn(pdev) != qm->pdev) {
 		pci_err(qm->pdev, "the pdev input does not match the pf!\n");
+		put_device(dev);
 		return -EINVAL;
 	}
 
 	*fun_index = pdev->devfn;
+	put_device(dev);
 
 	return 0;
 }
-- 
2.39.5 (Apple Git-154)

On Mon, Oct 27, 2025 at 11:09:34PM +0800, Miaoqian Lin wrote:
> The qm_get_qos_value() function calls bus_find_device_by_name() which
> increases the device reference count, but fails to call put_device()
> to balance the reference count and lead to a device reference leak.
> 
> Add put_device() calls in both the error path and success path to
> properly balance the reference count.
> 
> Found via static analysis.
> 
> Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check")
> Cc: stable@vger.kernel.org
> Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
> ---
>  drivers/crypto/hisilicon/qm.c | 2 ++
>  1 file changed, 2 insertions(+)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

On 2025/10/27 23:09, Miaoqian Lin wrote:
> The qm_get_qos_value() function calls bus_find_device_by_name() which
> increases the device reference count, but fails to call put_device()
> to balance the reference count and lead to a device reference leak.
> 
> Add put_device() calls in both the error path and success path to
> properly balance the reference count.
> 
> Found via static analysis.
> 
> Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check")
> Cc: stable@vger.kernel.org
> Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
> ---
>  drivers/crypto/hisilicon/qm.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
> index a5b96adf2d1e..3b391a146635 100644
> --- a/drivers/crypto/hisilicon/qm.c
> +++ b/drivers/crypto/hisilicon/qm.c
> @@ -3871,10 +3871,12 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf,
>  	pdev = container_of(dev, struct pci_dev, dev);
>  	if (pci_physfn(pdev) != qm->pdev) {
>  		pci_err(qm->pdev, "the pdev input does not match the pf!\n");
> +		put_device(dev);
>  		return -EINVAL;
>  	}
>  
>  	*fun_index = pdev->devfn;
> +	put_device(dev);
>  
>  	return 0;
>  }
> 

Reviewed-by: Longfang Liu <liulongfang@huawei.com>

Thanks.