bus_find_device() returns a device with its reference count
incremented. coresight_get_sink_by_id() only uses the returned device
to find the matching CoreSight sink by id and does not need to
transfer this lookup reference to its callers.

Keeping the reference forces callers such as etm_setup_aux() to know
about the internal lookup implementation and to drop the reference
themselves. This is error-prone and led to a leaked reference when a
user-selected sink is used for perf AUX tracing.

Drop the reference inside coresight_get_sink_by_id() after converting
the device to the corresponding coresight_device. The CoreSight path
code takes device references it needs when building/using the path.

Found by code review.

Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Cc: stable@vger.kernel.org
Fixes: 226443925887 ("coresight: Use event attributes for sink selection")
---
 drivers/hwtracing/coresight/coresight-core.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
index 46f247f73cf6..2cca4ed83e2c 100644
--- a/drivers/hwtracing/coresight/coresight-core.c
+++ b/drivers/hwtracing/coresight/coresight-core.c
@@ -624,11 +624,24 @@ static int coresight_sink_by_id(struct device *dev, const void *data)
 struct coresight_device *coresight_get_sink_by_id(u32 id)
 {
 	struct device *dev = NULL;
+	struct coresight_device *csdev;
 
 	dev = bus_find_device(&coresight_bustype, NULL, &id,
 			      coresight_sink_by_id);
+	if (!dev)
+		return NULL;
+
+	csdev = to_coresight_device(dev);
+
+	/*
+	 * bus_find_device() returns a device with its reference count
+	 * incremented. coresight_get_sink_by_id() only performs a lookup;
+	 * the CoreSight path code takes the references it needs when the
+	 * path is built, so drop the lookup reference here.
+	 */
+	put_device(dev);
 
-	return dev ? to_coresight_device(dev) : NULL;
+	return csdev;
 }
 
 /**
-- 
2.43.0

On 19/05/2026 09:43, Ma Ke wrote:
> bus_find_device() returns a device with its reference count
> incremented. coresight_get_sink_by_id() only uses the returned device
> to find the matching CoreSight sink by id and does not need to
> transfer this lookup reference to its callers.
> 
> Keeping the reference forces callers such as etm_setup_aux() to know
> about the internal lookup implementation and to drop the reference
> themselves. This is error-prone and led to a leaked reference when a
> user-selected sink is used for perf AUX tracing.
> 
> Drop the reference inside coresight_get_sink_by_id() after converting
> the device to the corresponding coresight_device. The CoreSight path
> code takes device references it needs when building/using the path.
> 
> Found by code review.

Thanks for the report. But..


> 
> Signed-off-by: Ma Ke <make24@iscas.ac.cn>
> Cc: stable@vger.kernel.org
> Fixes: 226443925887 ("coresight: Use event attributes for sink selection")

I would rather drop the reference in the etm_setup_aux, to make sure we
are still dealing with a valid device, that has not been removed under
our feet.

Suzuki



> ---
>   drivers/hwtracing/coresight/coresight-core.c | 15 ++++++++++++++-
>   1 file changed, 14 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
> index 46f247f73cf6..2cca4ed83e2c 100644
> --- a/drivers/hwtracing/coresight/coresight-core.c
> +++ b/drivers/hwtracing/coresight/coresight-core.c
> @@ -624,11 +624,24 @@ static int coresight_sink_by_id(struct device *dev, const void *data)
>   struct coresight_device *coresight_get_sink_by_id(u32 id)
>   {
>   	struct device *dev = NULL;
> +	struct coresight_device *csdev;
>   
>   	dev = bus_find_device(&coresight_bustype, NULL, &id,
>   			      coresight_sink_by_id);
> +	if (!dev)
> +		return NULL;
> +
> +	csdev = to_coresight_device(dev);
> +
> +	/*
> +	 * bus_find_device() returns a device with its reference count
> +	 * incremented. coresight_get_sink_by_id() only performs a lookup;
> +	 * the CoreSight path code takes the references it needs when the
> +	 * path is built, so drop the lookup reference here.
> +	 */
> +	put_device(dev);
>   
> -	return dev ? to_coresight_device(dev) : NULL;
> +	return csdev;
>   }
>   
>   /**