intel_th_output_open() calls bus_find_device_by_devt() which internally increments the device reference count via get_device(), but this reference is not properly released in several error paths. When device driver is unavailable, file operations cannot be obtained, or the driver's open method fails, the function returns without calling put_device(), leading to a permanent device reference count leak. This prevents the device from being properly released and could cause resource exhaustion over time.
Found by code review.
Cc: stable@vger.kernel.org Fixes: 39f4034693b7 ("intel_th: Add driver infrastructure for Intel(R) Trace Hub devices") Signed-off-by: Ma Ke make24@iscas.ac.cn --- drivers/hwtracing/intel_th/core.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c index 47d9e6c3bac0..ecc4b4ff5cf6 100644 --- a/drivers/hwtracing/intel_th/core.c +++ b/drivers/hwtracing/intel_th/core.c @@ -811,12 +811,12 @@ static int intel_th_output_open(struct inode *inode, struct file *file)
dev = bus_find_device_by_devt(&intel_th_bus, inode->i_rdev); if (!dev || !dev->driver) - return -ENODEV; + goto out_no_device;
thdrv = to_intel_th_driver(dev->driver); fops = fops_get(thdrv->fops); if (!fops) - return -ENODEV; + goto out_put_device;
replace_fops(file, fops);
@@ -824,10 +824,16 @@ static int intel_th_output_open(struct inode *inode, struct file *file)
if (file->f_op->open) { err = file->f_op->open(inode, file); - return err; + if (err) + goto out_put_device; }
return 0; + +out_put_device: + put_device(dev); +out_no_device: + return err; }
static const struct file_operations intel_th_output_fops = {
Hi Ma,
kernel test robot noticed the following build warnings:
[auto build test WARNING on akpm-mm/mm-everything] [also build test WARNING on linus/master v6.18-rc5 next-20251111] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Ma-Ke/intel_th-Fix-error-hand... base: https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-everything patch link: https://lore.kernel.org/r/20251111024204.12299-1-make24%40iscas.ac.cn patch subject: [PATCH] intel_th: Fix error handling in intel_th_output_open config: x86_64-buildonly-randconfig-002-20251111 (https://download.01.org/0day-ci/archive/20251111/202511112222.vMmKmHbd-lkp@i...) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251111/202511112222.vMmKmHbd-lkp@i...)
If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot lkp@intel.com | Closes: https://lore.kernel.org/oe-kbuild-all/202511112222.vMmKmHbd-lkp@intel.com/
All warnings (new ones prefixed by >>):
drivers/hwtracing/intel_th/core.c:818:6: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
818 | if (!fops) | ^~~~~ drivers/hwtracing/intel_th/core.c:836:9: note: uninitialized use occurs here 836 | return err; | ^~~ drivers/hwtracing/intel_th/core.c:818:2: note: remove the 'if' if its condition is always false 818 | if (!fops) | ^~~~~~~~~~ 819 | goto out_put_device; | ~~~~~~~~~~~~~~~~~~~ drivers/hwtracing/intel_th/core.c:813:6: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] 813 | if (!dev || !dev->driver) | ^~~~~~~~~~~~~~~~~~~~ drivers/hwtracing/intel_th/core.c:836:9: note: uninitialized use occurs here 836 | return err; | ^~~ drivers/hwtracing/intel_th/core.c:813:2: note: remove the 'if' if its condition is always false 813 | if (!dev || !dev->driver) | ^~~~~~~~~~~~~~~~~~~~~~~~~ 814 | goto out_no_device; | ~~~~~~~~~~~~~~~~~~
drivers/hwtracing/intel_th/core.c:813:6: warning: variable 'err' is used uninitialized whenever '||' condition is true [-Wsometimes-uninitialized]
813 | if (!dev || !dev->driver) | ^~~~ drivers/hwtracing/intel_th/core.c:836:9: note: uninitialized use occurs here 836 | return err; | ^~~ drivers/hwtracing/intel_th/core.c:813:6: note: remove the '||' if its condition is always false 813 | if (!dev || !dev->driver) | ^~~~~~~ drivers/hwtracing/intel_th/core.c:810:9: note: initialize the variable 'err' to silence this warning 810 | int err; | ^ | = 0 3 warnings generated.
vim +818 drivers/hwtracing/intel_th/core.c
39f4034693b7c7 Alexander Shishkin 2015-09-22 804 39f4034693b7c7 Alexander Shishkin 2015-09-22 805 static int intel_th_output_open(struct inode *inode, struct file *file) 39f4034693b7c7 Alexander Shishkin 2015-09-22 806 { 39f4034693b7c7 Alexander Shishkin 2015-09-22 807 const struct file_operations *fops; 39f4034693b7c7 Alexander Shishkin 2015-09-22 808 struct intel_th_driver *thdrv; 39f4034693b7c7 Alexander Shishkin 2015-09-22 809 struct device *dev; 39f4034693b7c7 Alexander Shishkin 2015-09-22 810 int err; 39f4034693b7c7 Alexander Shishkin 2015-09-22 811 4495dfdd6193d9 Suzuki K Poulose 2019-07-23 812 dev = bus_find_device_by_devt(&intel_th_bus, inode->i_rdev); 39f4034693b7c7 Alexander Shishkin 2015-09-22 @813 if (!dev || !dev->driver) b54f5a424fbe0f Ma Ke 2025-11-11 814 goto out_no_device; 39f4034693b7c7 Alexander Shishkin 2015-09-22 815 39f4034693b7c7 Alexander Shishkin 2015-09-22 816 thdrv = to_intel_th_driver(dev->driver); 39f4034693b7c7 Alexander Shishkin 2015-09-22 817 fops = fops_get(thdrv->fops); 39f4034693b7c7 Alexander Shishkin 2015-09-22 @818 if (!fops) b54f5a424fbe0f Ma Ke 2025-11-11 819 goto out_put_device; 39f4034693b7c7 Alexander Shishkin 2015-09-22 820 39f4034693b7c7 Alexander Shishkin 2015-09-22 821 replace_fops(file, fops); 39f4034693b7c7 Alexander Shishkin 2015-09-22 822 39f4034693b7c7 Alexander Shishkin 2015-09-22 823 file->private_data = to_intel_th_device(dev); 39f4034693b7c7 Alexander Shishkin 2015-09-22 824 39f4034693b7c7 Alexander Shishkin 2015-09-22 825 if (file->f_op->open) { 39f4034693b7c7 Alexander Shishkin 2015-09-22 826 err = file->f_op->open(inode, file); b54f5a424fbe0f Ma Ke 2025-11-11 827 if (err) b54f5a424fbe0f Ma Ke 2025-11-11 828 goto out_put_device; 39f4034693b7c7 Alexander Shishkin 2015-09-22 829 } 39f4034693b7c7 Alexander Shishkin 2015-09-22 830 39f4034693b7c7 Alexander Shishkin 2015-09-22 831 return 0; b54f5a424fbe0f Ma Ke 2025-11-11 832 b54f5a424fbe0f Ma Ke 2025-11-11 833 out_put_device: b54f5a424fbe0f Ma Ke 2025-11-11 834 put_device(dev); b54f5a424fbe0f Ma Ke 2025-11-11 835 out_no_device: b54f5a424fbe0f Ma Ke 2025-11-11 @836 return err; 39f4034693b7c7 Alexander Shishkin 2015-09-22 837 } 39f4034693b7c7 Alexander Shishkin 2015-09-22 838
linux-stable-mirror@lists.linaro.org
-
kernel test robot -
Ma Ke