From nobody Mon Jun 15 20:35:03 2026 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ACF1C3CE49E for ; Mon, 13 Apr 2026 13:59:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776088752; cv=none; b=YdcMQWPcFt9xYeWHoZn2pPZZDQxBKSBPFx2UkgLnOLTO/D3huYyei/QAJB05sOqhfmrlXY/RgKmvayviKTkrd5mRGvUXQ6gyqPW6kKW29D4zWYvQfXfYoPcQUYUDY2z1EYW7rHzlngEQrmTyyXeBRfUAkF//pKqh/jlDMmMY+3c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776088752; c=relaxed/simple; bh=E1bWdw6PJOytikD+btPKFm6ySZ2cUlj2DalItE7SZlg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ZA9dKbyNa0hedmEk3ew9Axn6ArFmgf4dNChbpWQwrih6yfURQuxIfb99f1QwUcUk/oiei8pnk1ppYyzUPW5y4x0uQPU0wVorBNO7elN8bMSdSx4LaHZydqSGlkwHBUXoev67S7FzchjWkJv0Elyz/h1EwehX1IlvQxHIFJhF5cQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KlW24X3j; arc=none smtp.client-ip=209.85.214.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KlW24X3j" Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-2ab46931cf1so26292615ad.0 for ; Mon, 13 Apr 2026 06:59:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776088751; x=1776693551; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=S8FhF3uUQSDunhYBQX60vlfAQkaL9E0JASzbAwhTGYQ=; b=KlW24X3jwf21cRZVq/u0f+l27OFoD4psjxZu2WegsPAuyeGHJoql+LQ5IxeMLzZ+qv RAP7nLhtObAJ6hFdv3sRWOnj62GCxHLGMN/Xl+gU/hPuHrfh5u82jYXVWkZZNXdMFVmV vuddY/+6+bCBbOLlY9913paHGaXVl7K5Vr7++B7N2z1vRP8HVVGVk2E8erkOCQDpZYNX NcfvByerGOx8D4REVu/s8H7ohnfSJy8NwAfo6iXtpgCpcvP8chVcJ4B7wrMR3+ebPe47 MHA2yD2G0SURJzhkaDB7pSlvTc+dQpwKZ8EPGMgXWNEp8/C0uIBFSC8IgeArUM8IEIZb krYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776088751; x=1776693551; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=S8FhF3uUQSDunhYBQX60vlfAQkaL9E0JASzbAwhTGYQ=; b=fWcLkwTq4AykWScMeeAa3Wen3JIoUnCJkOPB6XWCdamRGAb7/PBbIAqTNUQEeYoBK2 Gr+hPU20im7uVVYW2EcmziNYjxDw+BO6Ml4HE4lzQN6xuBbBDk/npEGkdF+TeyaZiYm6 4CwR3kS/oZMQjhZeCGheOdURbhIM43oBzYORWx9oy/Ffsh0jiBq5OBio8znIWDQP7+GG y6HwPwSj0OKCJCZA7qcSGG97wyrfj5W7GzGRyb5W6y3b84KtG5ie8+Ni8BEFyu3nJzN+ a7ul27Ieel5p0Cz5be3KklwCVxTHwq1nUOxfRCLPYOtyQCijyS/iJGA9AILioufdVql3 gquA== X-Forwarded-Encrypted: i=1; AFNElJ9GtSuEgL38Yb1Zi1EK/ELjRq4T6d/tNB9Lmn2Yjvr7NhoX/qTfn/RB0++GF9GsPrRpH9nkpXuM8FGgtVY=@vger.kernel.org X-Gm-Message-State: AOJu0YyyaRpMxYmZibh/JSrJ+s3V7nR3c7uOnKAxnEmD1TdAx546dOrU LKBKHWjAmbkR2c0uPPWA4WSaZajS1XlGVQVu2mLDUkKsdVHmL6yRygP0 X-Gm-Gg: AeBDieu6sauSAV1/3H+xT0TH08IyBdAh0xP/4B7RdUxmo//vixmy7Sg7mfI9Fh2yd6q 3JijQN6eE2O0AEaOBhB3VfL5UW0CHQh772MFwhsZrIG5E/Tob3yBXt0THdhRzyi+aPgp5uaxCwB 3ZcN3o3fhj/+ZjkNJt7eUM6Cuv+x0/EqFy4vi/E5BuOfOZSHltUfLHKJzNBW4I6Ea16il1RiZqQ h1J3wcHILph1ZQbvUXyvwhaV0iReAPs00L1MOpEz9Tp1OXfba/OuS4d/FL2sMj1ho98tqqEO0wI eer5WHMp/d4JaFVWJ4xlFCNt5b+lVH3xeTqlL2T6QisSSndeoMKCB7UjWWK2vcRigTKQT4rK6jK epGItIvXfrw03RACxoZkRbTFvB6QyCqw6yc/x98UQUtg6J5H/e0xJZ+bGCVoDsfs87HndVJXK/E FRz2nqy5hfpLGq7kB1vJLaiqBwTCSR/PQ= X-Received: by 2002:a17:902:8489:b0:2b2:ec33:cf15 with SMTP id d9443c01a7336-2b2ec33d1b3mr34560675ad.7.1776088750988; Mon, 13 Apr 2026 06:59:10 -0700 (PDT) Received: from lgs.. ([2409:893d:1188:142d:6c67:74e8:5200:1f39]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b2d4dd6b1csm114842725ad.22.2026.04.13.06.59.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Apr 2026 06:59:10 -0700 (PDT) From: Guangshuo Li To: Vinod Koul , Dave Jiang , dmaengine@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li , stable@vger.kernel.org Subject: [PATCH v2] dmaengine: Fix refcount leak in channel register error path Date: Mon, 13 Apr 2026 21:58:57 +0800 Message-ID: <20260413135857.2898676-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" After device_register(), the lifetime of the embedded struct device is expected to be managed through the device core reference counting. In __dma_async_device_channel_register(), if device_register() fails, the error path frees chan->dev directly instead of releasing the device reference with put_device(). This bypasses the normal device lifetime rules and may leave the reference count of the embedded struct device unbalanced, resulting in a refcount leak. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix this by using put_device() in the device_register() failure path and let chan_dev_release() handle the final cleanup. Fixes: d2fb0a043838 ("dmaengine: break out channel registration") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- v2: - note that the issue was identified by my static analysis tool - and confirmed by manual review drivers/dma/dmaengine.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index ca13cd39330b..6bb1212ae0e1 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -1111,8 +1111,12 @@ static int __dma_async_device_channel_register(struc= t dma_device *device, =20 err_out_ida: ida_free(&device->chan_ida, chan->chan_id); + put_device(&chan->dev->device); + chan->dev =3D NULL; + goto err_free_local; err_free_dev: kfree(chan->dev); + chan->dev =3D NULL; err_free_local: free_percpu(chan->local); chan->local =3D NULL; --=20 2.43.0