From nobody Mon Mar 23 19:52:09 2026 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1AF2F3A9D9D for ; Mon, 23 Mar 2026 13:55:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774274155; cv=none; b=O32cVwVidUB+TLnuU2Xbr/Sxe+6tmBKGn+c46fYqdvfn67xUz0KmOMegxAFKbTkpSFt1ydTIK5/ZT767TB3Pbehof0oGdkxdZCMpx5UKio3LhGdN8a522w/s+EFpIidIfQ0k2AJlro6Y/FVwxlkG9IIX6QeM+5iFCYIam1KuaLw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774274155; c=relaxed/simple; bh=ptUbi7coE8TiCTgvjCOJdhXmMm9zZV1RIxnNmpsvNUY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=jLuySRahDniJUe+ZXZjgjfyC479FGiQCUlk2dS9rBC0HdRvxgZOAqJJ254yS4pvgQU4MZaa0MvVhaZyvDTQX31WKh5glFEEV3gMPoLY5TM3Zoc9f8yobNxOKFWGwYJTGvqmhDfOW2HSUTwwCN5xPAUEvMJBbkiwrFpoFnUkKIAg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SFjIkSLb; arc=none smtp.client-ip=209.85.214.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SFjIkSLb" Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-2b05761bec1so23663685ad.1 for ; Mon, 23 Mar 2026 06:55:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1774274153; x=1774878953; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=gX403DU43tnkaleCen3mlLyVekGcaUJRBonPOPbGQtY=; b=SFjIkSLb6hCeV6O6C0rMZn9Ic10VRNRaECLQK/c2sn6NWaZgQUEKdAr406SoSmeybA 4ZrkRBXuiQ68yXXDuqeCt6gYZ3oDHRaZuTr8nWD7xfJxBhEs5cgfXXwvGWnbdUJpBZFi Uv3x7AxkMJPm1VB+SlWCjugJVtQNqXphz9NU34oCJ/jFtP4LD1f9a0jt3rfQQ0ryXLhR vKAHVsMEMtn6CVqM42/umHMRZQYtU+nKOjoWchw/3RFy5zIQJTkWPsRc0Ya0LKOxueGX JzBcQS9q5j5oNnEZbErXiOZulbOrdZ114gyYzpIe0TdEVxtKFOSaJBIYEE1GlnwMzPym jAFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774274153; x=1774878953; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=gX403DU43tnkaleCen3mlLyVekGcaUJRBonPOPbGQtY=; b=QRJ/H2G+K+yTzpKey25E3UWY5AdzCFi3z+l7Bc9/7fb7j5ST5gj8ELVl2uixXxcnPu T8pSCN3llsS6KmsdViZJDaMgy6BsPIWYPm52zEnKmXZoErikGydok5FcyhXNBFgNvfnl zTI7jWo0nEIeoRlwhL7fIzZOgseYoxpBuQ38t3gmHzXdxfeq9uuSxTSMlS2XRbj3mCeh yemkPqm5MyBM2j+WGrzemWGuBUHn8bFP4vxPz18Hjv0JbTt+NU8lT31vOCF+QHy1WtfD wzC321ULiWJld4ViASM1abyHWaNPOEs3puIOIIvJfNR++J0cDk1KAL18EkBgJhNYh5kU KghQ== X-Forwarded-Encrypted: i=1; AJvYcCWOxj4OeheB322TW34So4VMIGGKEZQ9987qKuSHShpAluW17YcgL07Nn9BerbblqhV1HhC+9B+yiEPdP9U=@vger.kernel.org X-Gm-Message-State: AOJu0YwBYFD7gUMwnIcEk86bRYa1dYVB3U2+WR7EqEyjm5vYqNdNrhDL v8fso4KPvA8WifVuGLZFrjXRi+ea8hlatQKCDWRxNSwkD7y+6My9gw5WIXUesvp1 X-Gm-Gg: ATEYQzxE6V3ZLTddlsbkjBxjEUzd6j/b18OC9MdHoQkbp1p8lMZ1TnbQEQokX2GxsAx tcxJ2MpxNy6H7D6lZ6S8n4I90axXO7lMqy8UCglTIkv4M6yk7HrH9nJ9vQOjuX8RYPv2EIZpVUf JK07oIvUldRKoi660PpcE4jC08ulNBziR6uO3Ctppa6USa9KjBVvjw6p/JLsemmY6uta6LQrDGN 3rUK9YTiUYyadTh4DHJP3KIasgib2XkdpijQ09z2Mge0ykx3g81mXxI8Z6/i33TSaHEniEgLym5 RcZQsEYE4zmRQreQ9d/2PxB712EVCTKGcY69SMnP7ich51PEAR4s4OUg/yvzjj9G38sTpzm9bmN 7Eg8FyodfptqoSbmhh8g8bGJl6H4F1dSlzO6/SYq4lmc7aEwSRnO5Vw+UXC9TImRA+hvGwu5gol ZSJR6bL9/WCmyMWpsduvEN X-Received: by 2002:a17:902:db12:b0:2ae:7f85:33d1 with SMTP id d9443c01a7336-2b082636715mr116185785ad.0.1774274153320; Mon, 23 Mar 2026 06:55:53 -0700 (PDT) Received: from lgs.. ([223.80.110.53]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b083527f90sm108967095ad.19.2026.03.23.06.55.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 23 Mar 2026 06:55:53 -0700 (PDT) From: Guangshuo Li To: Yoshinori Sato , Rich Felker , John Paul Adrian Glaubitz , Guangshuo Li , Adrian McMenamin , Paul Mundt , linux-sh@vger.kernel.org, linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Subject: [PATCH] maple: Fix refcount leak in maple_attach_driver() error path Date: Mon, 23 Mar 2026 21:55:40 +0800 Message-ID: <20260323135540.922928-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" As device_register() calls device_initialize() before device_add(), the failure path in maple_attach_driver() is reached after the embedded struct device has already been initialized and its lifetime is expected to be managed through the device core reference counting. However, that path frees mdev and its associated resources directly via maple_free_dev(), rather than releasing them through put_device() and the normal release path. This may leave the reference count of the embedded struct device unbalanced, resulting in a refcount leak and potentially leading to a use-after-free. A possible fix would be to use put_device() in the error path and let maple_release_device() handle the final cleanup. Fixes: b3c69e248176 ("maple: more robust device detection.") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/sh/maple/maple.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c index 6dc0549f7900..20b7c2cd852b 100644 --- a/drivers/sh/maple/maple.c +++ b/drivers/sh/maple/maple.c @@ -393,7 +393,7 @@ static void maple_attach_driver(struct maple_device *md= ev) dev_warn(&mdev->dev, "could not register device at" " (%d, %d), with error 0x%X\n", mdev->unit, mdev->port, error); - maple_free_dev(mdev); + put_device(&mdev->dev); mdev =3D NULL; return; } --=20 2.43.0