drivers/hwtracing/intel_th/core.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
intel_th_output_open() calls bus_find_device_by_devt() which
internally increments the device reference count via get_device(), but
this reference is not properly released in several error paths. When
device driver is unavailable, file operations cannot be obtained, or
the driver's open method fails, the function returns without calling
put_device(), leading to a permanent device reference count leak. This
prevents the device from being properly released and could cause
resource exhaustion over time.
Found by code review.
Cc: stable@vger.kernel.org
Fixes: 39f4034693b7 ("intel_th: Add driver infrastructure for Intel(R) Trace Hub devices")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
---
drivers/hwtracing/intel_th/core.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
index 47d9e6c3bac0..ecc4b4ff5cf6 100644
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -811,12 +811,12 @@ static int intel_th_output_open(struct inode *inode, struct file *file)
dev = bus_find_device_by_devt(&intel_th_bus, inode->i_rdev);
if (!dev || !dev->driver)
- return -ENODEV;
+ goto out_no_device;
thdrv = to_intel_th_driver(dev->driver);
fops = fops_get(thdrv->fops);
if (!fops)
- return -ENODEV;
+ goto out_put_device;
replace_fops(file, fops);
@@ -824,10 +824,16 @@ static int intel_th_output_open(struct inode *inode, struct file *file)
if (file->f_op->open) {
err = file->f_op->open(inode, file);
- return err;
+ if (err)
+ goto out_put_device;
}
return 0;
+
+out_put_device:
+ put_device(dev);
+out_no_device:
+ return err;
}
static const struct file_operations intel_th_output_fops = {
--
2.17.1Hi Ma,
kernel test robot noticed the following build warnings:
[auto build test WARNING on akpm-mm/mm-everything]
[also build test WARNING on linus/master v6.18-rc5 next-20251111]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Ma-Ke/intel_th-Fix-error-handling-in-intel_th_output_open/20251111-104412
base: https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-everything
patch link: https://lore.kernel.org/r/20251111024204.12299-1-make24%40iscas.ac.cn
patch subject: [PATCH] intel_th: Fix error handling in intel_th_output_open
config: x86_64-buildonly-randconfig-002-20251111 (https://download.01.org/0day-ci/archive/20251111/202511112222.vMmKmHbd-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251111/202511112222.vMmKmHbd-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202511112222.vMmKmHbd-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> drivers/hwtracing/intel_th/core.c:818:6: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
818 | if (!fops)
| ^~~~~
drivers/hwtracing/intel_th/core.c:836:9: note: uninitialized use occurs here
836 | return err;
| ^~~
drivers/hwtracing/intel_th/core.c:818:2: note: remove the 'if' if its condition is always false
818 | if (!fops)
| ^~~~~~~~~~
819 | goto out_put_device;
| ~~~~~~~~~~~~~~~~~~~
drivers/hwtracing/intel_th/core.c:813:6: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
813 | if (!dev || !dev->driver)
| ^~~~~~~~~~~~~~~~~~~~
drivers/hwtracing/intel_th/core.c:836:9: note: uninitialized use occurs here
836 | return err;
| ^~~
drivers/hwtracing/intel_th/core.c:813:2: note: remove the 'if' if its condition is always false
813 | if (!dev || !dev->driver)
| ^~~~~~~~~~~~~~~~~~~~~~~~~
814 | goto out_no_device;
| ~~~~~~~~~~~~~~~~~~
>> drivers/hwtracing/intel_th/core.c:813:6: warning: variable 'err' is used uninitialized whenever '||' condition is true [-Wsometimes-uninitialized]
813 | if (!dev || !dev->driver)
| ^~~~
drivers/hwtracing/intel_th/core.c:836:9: note: uninitialized use occurs here
836 | return err;
| ^~~
drivers/hwtracing/intel_th/core.c:813:6: note: remove the '||' if its condition is always false
813 | if (!dev || !dev->driver)
| ^~~~~~~
drivers/hwtracing/intel_th/core.c:810:9: note: initialize the variable 'err' to silence this warning
810 | int err;
| ^
| = 0
3 warnings generated.
vim +818 drivers/hwtracing/intel_th/core.c
39f4034693b7c7 Alexander Shishkin 2015-09-22 804
39f4034693b7c7 Alexander Shishkin 2015-09-22 805 static int intel_th_output_open(struct inode *inode, struct file *file)
39f4034693b7c7 Alexander Shishkin 2015-09-22 806 {
39f4034693b7c7 Alexander Shishkin 2015-09-22 807 const struct file_operations *fops;
39f4034693b7c7 Alexander Shishkin 2015-09-22 808 struct intel_th_driver *thdrv;
39f4034693b7c7 Alexander Shishkin 2015-09-22 809 struct device *dev;
39f4034693b7c7 Alexander Shishkin 2015-09-22 810 int err;
39f4034693b7c7 Alexander Shishkin 2015-09-22 811
4495dfdd6193d9 Suzuki K Poulose 2019-07-23 812 dev = bus_find_device_by_devt(&intel_th_bus, inode->i_rdev);
39f4034693b7c7 Alexander Shishkin 2015-09-22 @813 if (!dev || !dev->driver)
b54f5a424fbe0f Ma Ke 2025-11-11 814 goto out_no_device;
39f4034693b7c7 Alexander Shishkin 2015-09-22 815
39f4034693b7c7 Alexander Shishkin 2015-09-22 816 thdrv = to_intel_th_driver(dev->driver);
39f4034693b7c7 Alexander Shishkin 2015-09-22 817 fops = fops_get(thdrv->fops);
39f4034693b7c7 Alexander Shishkin 2015-09-22 @818 if (!fops)
b54f5a424fbe0f Ma Ke 2025-11-11 819 goto out_put_device;
39f4034693b7c7 Alexander Shishkin 2015-09-22 820
39f4034693b7c7 Alexander Shishkin 2015-09-22 821 replace_fops(file, fops);
39f4034693b7c7 Alexander Shishkin 2015-09-22 822
39f4034693b7c7 Alexander Shishkin 2015-09-22 823 file->private_data = to_intel_th_device(dev);
39f4034693b7c7 Alexander Shishkin 2015-09-22 824
39f4034693b7c7 Alexander Shishkin 2015-09-22 825 if (file->f_op->open) {
39f4034693b7c7 Alexander Shishkin 2015-09-22 826 err = file->f_op->open(inode, file);
b54f5a424fbe0f Ma Ke 2025-11-11 827 if (err)
b54f5a424fbe0f Ma Ke 2025-11-11 828 goto out_put_device;
39f4034693b7c7 Alexander Shishkin 2015-09-22 829 }
39f4034693b7c7 Alexander Shishkin 2015-09-22 830
39f4034693b7c7 Alexander Shishkin 2015-09-22 831 return 0;
b54f5a424fbe0f Ma Ke 2025-11-11 832
b54f5a424fbe0f Ma Ke 2025-11-11 833 out_put_device:
b54f5a424fbe0f Ma Ke 2025-11-11 834 put_device(dev);
b54f5a424fbe0f Ma Ke 2025-11-11 835 out_no_device:
b54f5a424fbe0f Ma Ke 2025-11-11 @836 return err;
39f4034693b7c7 Alexander Shishkin 2015-09-22 837 }
39f4034693b7c7 Alexander Shishkin 2015-09-22 838
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
© 2016 - 2026 Red Hat, Inc.