tty_find_polling_driver() returns the tty driver with an extra
reference taken by tty_driver_kref_get(). configure_kgdboc() stores it
in kgdb_tty_driver but the reference is never dropped: it is leaked when
kgdb_register_io_module() fails, when the configuration is cleared, and
on every reconfigure.

Release the reference both when unconfiguring and on the error path.

Fixes: 7d7b93c1452f ("tty: kref the tty driver object")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/tty/serial/kgdboc.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
index 5a955c80a853..e2c8e5ec688c 100644
--- a/drivers/tty/serial/kgdboc.c
+++ b/drivers/tty/serial/kgdboc.c
@@ -188,6 +188,11 @@ static void cleanup_kgdboc(void)
 
 	kgdboc_unregister_kbd();
 	kgdb_unregister_io_module(&kgdboc_io_ops);
+
+	if (kgdb_tty_driver) {
+		tty_driver_kref_put(kgdb_tty_driver);
+		kgdb_tty_driver = NULL;
+	}
 }
 
 static int configure_kgdboc(void)
@@ -254,6 +259,10 @@ static int configure_kgdboc(void)
 
 noconfig:
 	kgdboc_unregister_kbd();
+	if (kgdb_tty_driver) {
+		tty_driver_kref_put(kgdb_tty_driver);
+		kgdb_tty_driver = NULL;
+	}
 	configured = 0;
 
 	return err;
-- 
2.34.1

Hi,

On Thu, Sep 17, 2026 at 8:55 AM Wentao Liang <vulab@iscas.ac.cn> wrote:
>
> tty_find_polling_driver() returns the tty driver with an extra
> reference taken by tty_driver_kref_get(). configure_kgdboc() stores it
> in kgdb_tty_driver but the reference is never dropped: it is leaked when
> kgdb_register_io_module() fails, when the configuration is cleared, and
> on every reconfigure.
>
> Release the reference both when unconfiguring and on the error path.
>
> Fixes: 7d7b93c1452f ("tty: kref the tty driver object")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/tty/serial/kgdboc.c | 9 +++++++++
>  1 file changed, 9 insertions(+)

Looks right to me. Even the "Fixes" looks right since the tty change
landed after kgdb was added to the mainline kernel (by a ~6 months).

Reviewed-by: Douglas Anderson <dianders@chromium.org>