diff options
| author | Guangshuo Li <lgs201920130244@gmail.com> | 2026-04-13 21:46:04 +0800 |
|---|---|---|
| committer | William Breathitt Gray <wbg@kernel.org> | 2026-05-03 13:48:39 +0900 |
| commit | d9eeb0ea0d2de658663bfaa9c26eccdd8fd64440 (patch) | |
| tree | 3faf59ef463ab320b77beaa1454a76aba0aefc8b /drivers | |
| parent | 254f49634ee16a731174d2ae34bc50bd5f45e731 (diff) | |
counter: Fix refcount leak in counter_alloc() error path
After device_initialize(), the lifetime of the embedded struct device
is expected to be managed through the device core reference counting.
In counter_alloc(), if dev_set_name() fails after device_initialize(),
the error path removes the chrdev, frees the ID, and frees the backing
allocation directly instead of releasing the device reference with
put_device(). This bypasses the normal device lifetime rules and may
leave the reference count of the embedded struct device unbalanced,
resulting in a refcount leak.
The issue was identified by a static analysis tool I developed and
confirmed by manual review.
Fix this by using put_device() in the dev_set_name() failure path and
let counter_device_release() handle the final cleanup.
Fixes: 4da08477ea1f ("counter: Set counter device name")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://lore.kernel.org/r/20260413134604.2861772-1-lgs201920130244@gmail.com
Signed-off-by: William Breathitt Gray <wbg@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/counter/counter-core.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/counter/counter-core.c b/drivers/counter/counter-core.c index 50bd30ba3d03..0b1dac61b7b5 100644 --- a/drivers/counter/counter-core.c +++ b/drivers/counter/counter-core.c @@ -124,7 +124,8 @@ struct counter_device *counter_alloc(size_t sizeof_priv) err_dev_set_name: - counter_chrdev_remove(counter); + put_device(dev); + return NULL; err_chrdev_add: ida_free(&counter_ida, dev->id); |