Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

intel_th: Fix error handling in intel_th_output_open

intel_th_output_open() calls bus_find_device_by_devt() which
internally increments the device reference count via get_device(), but
this reference is not properly released in several error paths. When
device driver is unavailable, file operations cannot be obtained, or
the driver's open method fails, the function returns without calling
put_device(), leading to a permanent device reference count leak. This
prevents the device from being properly released and could cause
resource exhaustion over time.

Found by code review.

Cc: stable <stable@kernel.org>
Fixes: 39f4034693b7 ("intel_th: Add driver infrastructure for Intel(R) Trace Hub devices")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Link: https://patch.msgid.link/20251112091723.35963-1-make24@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Ma Ke and committed by
Greg Kroah-Hartman
6d5925b6 43cd4b63

+15 -5
+15 -5
drivers/hwtracing/intel_th/core.c
··· 810 810 int err; 811 811 812 812 dev = bus_find_device_by_devt(&intel_th_bus, inode->i_rdev); 813 - if (!dev || !dev->driver) 814 - return -ENODEV; 813 + if (!dev || !dev->driver) { 814 + err = -ENODEV; 815 + goto out_no_device; 816 + } 815 817 816 818 thdrv = to_intel_th_driver(dev->driver); 817 819 fops = fops_get(thdrv->fops); 818 - if (!fops) 819 - return -ENODEV; 820 + if (!fops) { 821 + err = -ENODEV; 822 + goto out_put_device; 823 + } 820 824 821 825 replace_fops(file, fops); 822 826 ··· 828 824 829 825 if (file->f_op->open) { 830 826 err = file->f_op->open(inode, file); 831 - return err; 827 + if (err) 828 + goto out_put_device; 832 829 } 833 830 834 831 return 0; 832 + 833 + out_put_device: 834 + put_device(dev); 835 + out_no_device: 836 + return err; 835 837 } 836 838 837 839 static const struct file_operations intel_th_output_fops = {