From nobody Mon Jun 15 15:09:29 2026 Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 196B21DC985 for ; Sat, 11 Apr 2026 14:23:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775917421; cv=none; b=Gne9y/4ZSSO/fQ8h4tCRZM4CdjcICUC6h8gChoB/cp0tOVrpR+IVoG4D9dA0V1RmZCf0ZZOdM7TM4VAVahIwtwitWiz6PpPKQ6in/jgOcd9vnnHsXZf+nbseSMwhwF6YPDZRJx4TtsJzBgxjK2BomTtbFuBQvmnFega880Lpa1g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775917421; c=relaxed/simple; bh=zjdX+fDP4DZujxewV7f8h2w2dNgyoukQyBkWuCBGgX8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=QDBuR/BYqWD/mJ2M6EZTRoq0n4sUZLpixSDuhPxLtmViBVyJa/BhT2/pzGDkoDydGgKMtAYvY2ABGs9voCaLulhWxYnuxFuCB5VKNb4u3oAMmSavw89LD/fvLqCCUhgRwY92GM/WzCVYDK2dZEBut5fQePL9EThLwJEd+jfaYIE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=VypOYZ06; arc=none smtp.client-ip=209.85.210.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="VypOYZ06" Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-823c56765fdso1833257b3a.1 for ; Sat, 11 Apr 2026 07:23:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775917419; x=1776522219; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=TremzrygKXcYa02v0/L5LdhZrn3TlivFlrGomrxLn3A=; b=VypOYZ06m0rP896JPbDzy7IU5MwemGaESPkzI5g4u63yHjL9wjGkGyLFow9+J/t+6A /AQm/5bTAk74LWTxe0hxZJFuq7GQm6kXwBq0uNFjcwykkUROu/ieLhv/8gd2/tPfgNc+ kVWkbjOh863yWJMjOAsYugTe1iUY8N9tqtDaG1gcVDJ6lpZRReFXu8s0N4Q+hBI54luj zfzxjXqIoiosKk9PERbmE58CDO1wYu2/CAKK3tSBfffqWpohxAqr3o6oktjEkJS9uDeb 90yr0NoO73TD4WpobfbhZztm5bKKuNF4Ha70lTtgELJCXuypHv2RN9INianbcS0n3tgu mJqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775917419; x=1776522219; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=TremzrygKXcYa02v0/L5LdhZrn3TlivFlrGomrxLn3A=; b=hXS+qNe0v7V02pKdcXDDLWYrZ+rzzT4BjAliwQ6bWpOqMRSAcWVtR9679oZXnHUDQD xNtSfflL3PknMNKEYqYKH8TAT5TDb/LM28vpB5EvWJqTNiYNQuWFV3+4aHi15IMYGEd4 DEPbcJTmEk8B7AMXkZkCePhpMkn3bfcmn3TLx4eOfs4rjIRPXTyxKkc3cji0UKGfT4C5 JwRZb+5+ho4yAo064M3UrbrUY8II37sMWh/r6SVc388cWfqob/zVPqLX3iE0ZN3vARsh uFInmRiCIIorvzsZcy82YpXRh5fnoEWSvz9WvlZIQUtiqPYZDesYL1GfvUh3h4SKfqVZ 4tvQ== X-Forwarded-Encrypted: i=1; AJvYcCUuuKr2RPMSTzs7Kj5ju98myjl9UZ0VDzzrLggHPPEIb3MHOLeDDRmmsI2ST0qdSHOOocCVKhxsK8oUrCg=@vger.kernel.org X-Gm-Message-State: AOJu0Yx/ZeIegjKS5UQSkQm0I3QFyKQ0holijzU8ocdQs/XACTdnPkME zH1xlDX1GFok+KrAhSzTTDW64jk26r03gJuRb9hC9JGHuaxE5JeUsRzv X-Gm-Gg: AeBDievrO+yK/156h2Xvrlo1jidO+VIdSinrdunakRWw7GJc1EFUm3mUWFyqDzSFw5v pwxfdAcFkGci4UrUtVlx5tW6Wx+ddUl64ptO7tcpk7e3k8AhYaCarvwX4L7gil6Il9kVt4EAeSS iGUTpWrKrB1PdRIrPXtyYnL71J15PuoVbByJEqXrrzF/1VaK6iSwXldxCB5xgEGleyM/L7qTumL 0BiYSMx+PQXwL4q5sRuUHCrjgTD+CqxvqOhRKlwlnBzDnEm/SQxXkZy+4zv9zKj1s13Uk2wtoMF Bz2Ew6+pwR1TdedbZpI3k0+UccgvKUOVLM6qJ4NXH4W0anG8sDKgKLUkNCX7IRZ4+/lEL56sDe1 Bz/GNY7KRszyZ1LDw07rRXhbK0E0tjM0r3q76km+vStc2J7gmzWQpDHl3Df63NlfsJaGgocsuWX AwT2YRUx+LXu2Pgg== X-Received: by 2002:a05:6a00:aa85:b0:829:8942:2c93 with SMTP id d2e1a72fcca58-82f0c1cc16emr6636314b3a.9.1775917419425; Sat, 11 Apr 2026 07:23:39 -0700 (PDT) Received: from lgs.. ([101.32.189.54]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-82f0c4b6d43sm5250995b3a.31.2026.04.11.07.23.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 11 Apr 2026 07:23:39 -0700 (PDT) From: Guangshuo Li To: "Rafael J. Wysocki" , Len Brown , Lin Ming , Hugh Dickins , linux-acpi@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li , stable@vger.kernel.org Subject: [PATCH v2] ACPI: scan: Use acpi_dev_put() in object add error paths Date: Sat, 11 Apr 2026 22:23:30 +0800 Message-ID: <20260411142330.2273618-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" After acpi_init_device_object(), the lifetime of struct acpi_device is managed by the driver core through reference counting. Both acpi_add_power_resource() and acpi_add_single_object() call acpi_init_device_object() and then invoke acpi_device_add(). If that fails, their error paths call the release callback directly instead of dropping the device reference through acpi_dev_put(). This bypasses the normal device lifetime rules and frees the object without releasing the reference acquired by device_initialize(), which may lead to a refcount leak and potentially a use-after-free. Fix both error paths by using acpi_dev_put() and let the release callback handle the final cleanup. Fixes: 781d737c7466 ("ACPI: Drop power resources driver") Fixes: 718fb0de8ff88 ("ACPI: fix NULL bug for HID/UID string") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- v2: - Use acpi_dev_put() instead of put_device() - Fix acpi_add_single_object() together with acpi_add_power_resource() - Update the subject and commit message accordingly drivers/acpi/power.c | 2 +- drivers/acpi/scan.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c index 361a7721a6a8..542e182f94f1 100644 --- a/drivers/acpi/power.c +++ b/drivers/acpi/power.c @@ -991,7 +991,7 @@ struct acpi_device *acpi_add_power_resource(acpi_handle= handle) return device; =20 err: - acpi_release_power_resource(&device->dev); + acpi_dev_put(device); return NULL; } =20 diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c index 416d87f9bd10..5124ed02debc 100644 --- a/drivers/acpi/scan.c +++ b/drivers/acpi/scan.c @@ -1910,7 +1910,7 @@ static int acpi_add_single_object(struct acpi_device = **child, result =3D acpi_device_add(device); =20 if (result) { - acpi_device_release(&device->dev); + acpi_dev_put(device); return result; } =20 --=20 2.43.0