On 18.07.25 10:29:40, Ma Ke wrote:

cxl_find_region_by_name() uses device_find_child_by_name() to locate a region device by name. This function implicitly increments the device's reference count before returning the pointer by calling device_find_child(). However, in delete_region_store(), after calling devm_release_action() which synchronously executes unregister_region(), an additional explicit put_device() is invoked. The unregister_region() callback already contains a put_device() call to decrement the reference count. This results in two consecutive decrements of the same device's reference count. First decrement occurs in unregister_region() via its put_device() call. Second decrement occurs in delete_region_store() via the explicit put_device(). We should remove the additional put_device().

As comment of device_find_child() says, 'NOTE: you will need to drop the reference with put_device() after use'.

Found by code review.

Cc: stable@vger.kernel.org Fixes: 779dd20cfb56 ("cxl/region: Add region creation support") Signed-off-by: Ma Ke make24@iscas.ac.cn

---

drivers/cxl/core/region.c | 1 - 1 file changed, 1 deletion(-)

diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c index 6e5e1460068d..eacf726cf463 100644 --- a/drivers/cxl/core/region.c +++ b/drivers/cxl/core/region.c @@ -2672,7 +2672,6 @@ static ssize_t delete_region_store(struct device *dev, return PTR_ERR(cxlr); devm_release_action(port->uport_dev, unregister_region, cxlr);

• put_device(&cxlr->dev);

cxl_find_region_by_name() increments the ref count in addition. So the ref count could be e.g. 2. This put_device() here only decrements it once to have the same ref count as it was before calling the find. The put_device() in unregister_region clears the ref count, which causes the release function to be called.

So, no, we need both and we may not change the code.

Thanks,

-Robert

return len; } -- 2.25.1