From nobody Tue Apr 14 13:59:21 2026 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A669370D75 for ; Tue, 14 Apr 2026 07:13:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776150810; cv=none; b=ILDm5XMJa/A5qjh5WCkaQBOmEKB8bxVsA7cHmGxacvGUuAjDaVdpzz91ycSIqWtjxMjsHaswOG3fy0mDysR1kk+U04YQKMQs3rIZksfQyEauUwlUjoxI7OtnBQhlqI17KRbLf0NSRQI0B7iy32hUigrlyftI2ZnkGTxEng5lj8g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776150810; c=relaxed/simple; bh=fsj9+YvgQO0AmxG3mtdBbsBPIhzpZ+Jh/dtK/CY/D0I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=D0dBJBWjLBgIObQD/zszA2FlXN9e3kZKoTSeUTg2cQJ6zjClyMTsvORHQYlrD28js9x7+a+nRpGDsQIncqR/7crtQlUOw948Cs8xU5BXv8KVBuV/UH+tPAKcEd/W/nsOAyOq7nwu3NUXV2V8fmRJH3PXU42OB14fe7oIRMt11R0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=aOQ9wBRv; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="aOQ9wBRv" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-35e576110adso1376629a91.0 for ; Tue, 14 Apr 2026 00:13:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776150809; x=1776755609; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=d79HgUISkhtoo22RFafauYvd4MagEF+p+1C/yzkS9eY=; b=aOQ9wBRv4KwB2+GPOmaWhffR8wdrgH7qUkL/N2Ba8NAy89Dv1DGcOjDB1RFwVE5Uv+ xWMJ7OhzMKPetsfkh0KF7y6lN9sUSzXJdI8aLEmn0LShRt5V33oZJyPD7ZdDBLUL9vBb VPc/2dWBR9hBiBrYaNdYvn0fciUiGszNIOhJXXZPGpmYSNJ3/LFgbahzgudcMIvpxOrc iLjs4mRUTEewGMmfkbNesjLApf+3dIStGxW5UoyVbXFuzFyP4l5Ea1AXSdsLe9K5htMz QGgavu6OgmjXuyH3BP8J6XrNTHMeUKRJ9VDTWwKPW1HLmeeLVyMyhnEQ8Em2ywgQ1UVj 5cUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776150809; x=1776755609; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=d79HgUISkhtoo22RFafauYvd4MagEF+p+1C/yzkS9eY=; b=HzAJBSmMlEZEblnlAFogSIWujmjTLwzzhZzBMCgdZJu1qg1dvqlVToZIv8p2T750HF kVqhN8LJ73KDvnrAM9qxSuRQIUivLYTCB/AlYvEeY7A6gomkOSiyoHE5HPVC228Op5Vz B/2tTyk4J1iMfklYpyjOlUQUUgDp03CHWIdGPiCOcKKx4TvOtcYZa8BiC2xI2AiKx4V3 YBVjhbMqMEehvskn2/YkeWKEjrpNnrG89ck5gGjmk1FfLNkCNLjKTMbTHkDqemVoq1Z8 Uym/Z64SIOWDP5c7d5SFayQ4NwllmZTivp5MBCttH7mal87PyfY3QW5dJ1UosyaWJIfw o21A== X-Gm-Message-State: AOJu0Yy4n23bjO9XMWZKAlukDj3PZ8c7Pyd1jAmfqlSJgRlA2viT/UJ9 BXbT4KrKOQ7B4BRcT+pQ754AzzjwByczYqxKLV/RxIkj3klH/YHkHjVr X-Gm-Gg: AeBDiev2euQ+TuaCE0jWaDuP9b6sgKzitG/VGx2DZpl8+UpKoJ0tPxcfuqGWV+Qx4f1 24/7/6uxC1nbx+N5vnTRKHs9+VV3sqhvuCp1aZ4ZBGqQeIh+KatBd3nYLKCmyblm5dXZIwzUqvJ iik/JMR2Ti6lWWi9mch2dzLqHVzcMmNH7ZHW/Ik22f3HWo6t+urVahsbKl8pAq+zKeYjyGtRMLh tpHHKW/VGJUzeeXBxGNTWXb8nRH4264riSoDNqIpxAhsUxCR8zfwJNMkTcYLq+lj98xpnmIu+nK YidJU58X7NfzS5NpLoacy+0/eT83sBb/l9WlLJiWDQVPPg+jyaY/SIAWg1vIGf3TV7Mkbjcbhqp RdFRPodbE6bSRuvQdEqqBHfWNTXZ+b8nbsKauTrvt17qSQ+8O4hVB88ws9lRrrhOTbjPJ3wJsDu Ho2mIeK1oo1tXi/v4IcusXEkeZmBIi0/hwf26edzeQH61aYzZ2CZx/n3wfPv4aoGBD3kz3DUETV 7TTkAdEL+Xm4v8y X-Received: by 2002:a17:90b:4c0e:b0:35f:b931:d1c0 with SMTP id 98e67ed59e1d1-35fb931d34emr5043694a91.6.1776150807333; Tue, 14 Apr 2026 00:13:27 -0700 (PDT) Received: from localhost.localdomain ([103.129.135.34]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-35fc6eac856sm1120134a91.17.2026.04.14.00.13.25 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 14 Apr 2026 00:13:27 -0700 (PDT) From: Shuvam Pandey To: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Subject: [PATCH] mISDN: socket: drop device references acquired by get_mdevice() Date: Tue, 14 Apr 2026 12:58:22 +0545 Message-ID: <20260414071322.30851-1-shuvampandey1@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" get_mdevice() wraps class_find_device(), which returns a device with a reference held. socket.c leaks those references in two places. IMGETDEVINFO and IMSETDEVNAME never drop the temporary lookup reference, and the references stored in _pms(sk)->dev by base_sock_bind() and data_sock_bind() are never released when the socket is closed. Drop the temporary references after the ioctl completes, and release the stored device reference from the base and data socket release paths. Fixes: b36b654a7e82 ("mISDN: Create /sys/class/mISDN") Cc: stable@vger.kernel.org Signed-off-by: Shuvam Pandey --- drivers/isdn/mISDN/socket.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c index 77b900db1ca..9209ee68f9c 100644 --- a/drivers/isdn/mISDN/socket.c +++ b/drivers/isdn/mISDN/socket.c @@ -266,6 +266,11 @@ data_sock_release(struct socket *sock) =20 lock_sock(sk); =20 + if (_pms(sk)->dev) { + put_device(&_pms(sk)->dev->dev); + _pms(sk)->dev =3D NULL; + } + sock_orphan(sk); skb_queue_purge(&sk->sk_receive_queue); =20 @@ -387,6 +392,7 @@ data_sock_ioctl(struct socket *sock, unsigned int cmd, = unsigned long arg) strscpy(di.name, dev_name(&dev->dev), sizeof(di.name)); if (copy_to_user((void __user *)arg, &di, sizeof(di))) err =3D -EFAULT; + put_device(&dev->dev); } else err =3D -ENODEV; break; @@ -623,6 +629,11 @@ base_sock_release(struct socket *sock) if (!sk) return 0; =20 + if (_pms(sk)->dev) { + put_device(&_pms(sk)->dev->dev); + _pms(sk)->dev =3D NULL; + } + mISDN_sock_unlink(&base_sockets, sk); sock_orphan(sk); sock_put(sk); @@ -670,6 +681,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, = unsigned long arg) strscpy(di.name, dev_name(&dev->dev), sizeof(di.name)); if (copy_to_user((void __user *)arg, &di, sizeof(di))) err =3D -EFAULT; + put_device(&dev->dev); } else err =3D -ENODEV; break; @@ -683,10 +695,12 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd= , unsigned long arg) } dn.name[sizeof(dn.name) - 1] =3D '\0'; dev =3D get_mdevice(dn.id); - if (dev) + if (dev) { err =3D device_rename(&dev->dev, dn.name); - else + put_device(&dev->dev); + } else { err =3D -ENODEV; + } } break; default: --=20 2.50.1 (Apple Git-155)