From nobody Sun Feb 8 06:49:40 2026 Received: from cstnet.cn (smtp81.cstnet.cn [159.226.251.81]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0EC76330328; Tue, 11 Nov 2025 02:42:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.81 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762828945; cv=none; b=s8b5yogVBtNvMHr+HSeOmWEdhjv1wioa04fkl4JwZfbC6+Ase8raMkJPF1DdhPyYEyg1vZnBtPp4wncC0qiihHYq1/HQPm1x2f3Bok4lwwxRPb3W8Tl3/yGJcM4hVbiI0h0OQNZv6tOV6YMj9F/6yJjizNyr+uzred/IX5jFMp4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762828945; c=relaxed/simple; bh=FEJlVZE4VYuYRy/TOHtqLsuPVa39R0INDIqRum5FX7w=; h=From:To:Cc:Subject:Date:Message-Id; b=a9mhPEiIL5+9PdmvPWnnBY7YJfJFnaM5bdA0fQhBLGmrMKLFwLzTWNJ+des/L73/rp7Ygp7pVn7P4QRIcyR+dJw8z7EG2Hf3S9nXr7VcPvho1CJKR+HgMY7LRNzS3q93ncvR9EflTi9W6lSC71g8TmWfUMvShgaY1dNkuuByNB8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.81 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [202.112.113.212]) by APP-03 (Coremail) with SMTP id rQCowAAXqdt9ohJpGV5PAA--.16295S2; Tue, 11 Nov 2025 10:42:13 +0800 (CST) From: Ma Ke To: alexander.shishkin@linux.intel.com, gregkh@linuxfoundation.org Cc: linux-kernel@vger.kernel.org, akpm@linux-foundation.org, Ma Ke , stable@vger.kernel.org Subject: [PATCH] intel_th: Fix error handling in intel_th_output_open Date: Tue, 11 Nov 2025 10:42:04 +0800 Message-Id: <20251111024204.12299-1-make24@iscas.ac.cn> X-Mailer: git-send-email 2.17.1 X-CM-TRANSID: rQCowAAXqdt9ohJpGV5PAA--.16295S2 X-Coremail-Antispam: 1UD129KBjvJXoW7Kr4fWw47tFy3ZrWkCw4xCrg_yoW8Cr4DpF WYqa98CFy5Gws29w4jqF45ZFyFkF1Iy3yFgFy8J3sYgFn5XrWYqrWrtFy5ZFy5XrWrJa4a qr1akrW8GFWUZFJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9j14x267AKxVWUJVW8JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26ryj6F1UM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U JVWxJr1l84ACjcxK6I8E87Iv67AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVCY1x0267AKxV W0oVCq3wAac4AC62xK8xCEY4vEwIxC4wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40E FcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr 0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8v x2IErcIFxwCY1x0262kKe7AKxVWUAVWUtwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7x kEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E 67AF67kF1VAFwI0_JF0_Jw1lIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCw CI42IY6xIIjxv20xvEc7CjxVAFwI0_Jr0_Gr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1x MIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Jr0_GrUvcSsGvf C2KfnxnUUI43ZEXa7VUjJ3vUUUUUU== X-CM-SenderInfo: ppdnvj2u6l2u1dvotugofq/ Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" intel_th_output_open() calls bus_find_device_by_devt() which internally increments the device reference count via get_device(), but this reference is not properly released in several error paths. When device driver is unavailable, file operations cannot be obtained, or the driver's open method fails, the function returns without calling put_device(), leading to a permanent device reference count leak. This prevents the device from being properly released and could cause resource exhaustion over time. Found by code review. Cc: stable@vger.kernel.org Fixes: 39f4034693b7 ("intel_th: Add driver infrastructure for Intel(R) Trac= e Hub devices") Signed-off-by: Ma Ke --- drivers/hwtracing/intel_th/core.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th= /core.c index 47d9e6c3bac0..ecc4b4ff5cf6 100644 --- a/drivers/hwtracing/intel_th/core.c +++ b/drivers/hwtracing/intel_th/core.c @@ -811,12 +811,12 @@ static int intel_th_output_open(struct inode *inode, = struct file *file) =20 dev =3D bus_find_device_by_devt(&intel_th_bus, inode->i_rdev); if (!dev || !dev->driver) - return -ENODEV; + goto out_no_device; =20 thdrv =3D to_intel_th_driver(dev->driver); fops =3D fops_get(thdrv->fops); if (!fops) - return -ENODEV; + goto out_put_device; =20 replace_fops(file, fops); =20 @@ -824,10 +824,16 @@ static int intel_th_output_open(struct inode *inode, = struct file *file) =20 if (file->f_op->open) { err =3D file->f_op->open(inode, file); - return err; + if (err) + goto out_put_device; } =20 return 0; + +out_put_device: + put_device(dev); +out_no_device: + return err; } =20 static const struct file_operations intel_th_output_fops =3D { --=20 2.17.1