Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

cpufreq: nforce2: fix reference count leak in nforce2

There are two reference count leaks in this driver:

1. In nforce2_fsb_read(): pci_get_subsys() increases the reference count
of the PCI device, but pci_dev_put() is never called to release it,
thus leaking the reference.

2. In nforce2_detect_chipset(): pci_get_subsys() gets a reference to the
nforce2_dev which is stored in a global variable, but the reference
is never released when the module is unloaded.

Fix both by:
- Adding pci_dev_put(nforce2_sub5) in nforce2_fsb_read() after reading
the configuration.
- Adding pci_dev_put(nforce2_dev) in nforce2_exit() to release the
global device reference.

Found via static analysis.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>

authored by

Miaoqian Lin and committed by
Viresh Kumar
9600156b 85976d37

+3
+3
drivers/cpufreq/cpufreq-nforce2.c
··· 145 145 pci_read_config_dword(nforce2_sub5, NFORCE2_BOOTFSB, &fsb); 146 146 fsb /= 1000000; 147 147 148 + pci_dev_put(nforce2_sub5); 149 + 148 150 /* Check if PLL register is already set */ 149 151 pci_read_config_byte(nforce2_dev, NFORCE2_PLLENABLE, (u8 *)&temp); 150 152 ··· 428 426 static void __exit nforce2_exit(void) 429 427 { 430 428 cpufreq_unregister_driver(&nforce2_driver); 429 + pci_dev_put(nforce2_dev); 431 430 } 432 431 433 432 module_init(nforce2_init);