intel_th_output_open() looks up the output device with
bus_find_device_by_devt(), which returns the device with a reference that
must be dropped after use.

The reference is currently intended to be dropped from
intel_th_output_release(). However, a successful open replaces
file->f_op with the output driver's file operations before returning, so
close runs the output driver's release method rather than
intel_th_output_release().

For MSC outputs, close runs intel_th_msc_release(). That release path
only removes the per-file iterator and does not drop the device
reference taken by intel_th_output_open(), so every successful MSC open
leaks one device reference.

Drop the device reference from intel_th_msc_release(), which is the
release path that is actually used for MSC output files.

Fixes: 95fc36a234da ("intel_th: fix device leak on output open()")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
v2:
  - Add Cc stable.
  - No code changes.

 drivers/hwtracing/intel_th/msu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
index a82cf74f39ad..84d99d7b1d20 100644
--- a/drivers/hwtracing/intel_th/msu.c
+++ b/drivers/hwtracing/intel_th/msu.c
@@ -1490,8 +1490,10 @@ static int intel_th_msc_release(struct inode *inode, struct file *file)
 {
 	struct msc_iter *iter = file->private_data;
 	struct msc *msc = iter->msc;
+	struct intel_th_device *thdev = msc->thdev;
 
 	msc_iter_remove(iter, msc);
+	put_device(&thdev->dev);
 
 	return 0;
 }
-- 
2.43.0

On Mon, Jul 13, 2026 at 08:02:05PM +0800, Guangshuo Li wrote:
> intel_th_output_open() looks up the output device with
> bus_find_device_by_devt(), which returns the device with a reference that
> must be dropped after use.
> 
> The reference is currently intended to be dropped from
> intel_th_output_release(). However, a successful open replaces
> file->f_op with the output driver's file operations before returning, so
> close runs the output driver's release method rather than
> intel_th_output_release().
> 
> For MSC outputs, close runs intel_th_msc_release(). That release path
> only removes the per-file iterator and does not drop the device
> reference taken by intel_th_output_open(), so every successful MSC open
> leaks one device reference.
> 
> Drop the device reference from intel_th_msc_release(), which is the
> release path that is actually used for MSC output files.
> 
> Fixes: 95fc36a234da ("intel_th: fix device leak on output open()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
> v2:
>   - Add Cc stable.
>   - No code changes.

You forgot to remove the intel_th_output_fops release callback as I
mentioned here:

	https://lore.kernel.org/all/aktZDK0NZrTdEqOm@hovoldconsulting.com/

Johan

On Mon, 13 Jul 2026 at 22:02, Johan Hovold <johan@kernel.org> wrote:
>
> On Mon, Jul 13, 2026 at 08:02:05PM +0800, Guangshuo Li wrote:
> > intel_th_output_open() looks up the output device with
> > bus_find_device_by_devt(), which returns the device with a reference that
> > must be dropped after use.
> >
> > The reference is currently intended to be dropped from
> > intel_th_output_release(). However, a successful open replaces
> > file->f_op with the output driver's file operations before returning, so
> > close runs the output driver's release method rather than
> > intel_th_output_release().
> >
> > For MSC outputs, close runs intel_th_msc_release(). That release path
> > only removes the per-file iterator and does not drop the device
> > reference taken by intel_th_output_open(), so every successful MSC open
> > leaks one device reference.
> >
> > Drop the device reference from intel_th_msc_release(), which is the
> > release path that is actually used for MSC output files.
> >
> > Fixes: 95fc36a234da ("intel_th: fix device leak on output open()")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> > ---
> > v2:
> >   - Add Cc stable.
> >   - No code changes.
>
> You forgot to remove the intel_th_output_fops release callback as I
> mentioned here:
>
>         https://lore.kernel.org/all/aktZDK0NZrTdEqOm@hovoldconsulting.com/
>
> Johan

Sorry about that. I’ll address it in v3.

Thanks,
Guangshuo