]> git.ipfire.org Git - thirdparty/linux.git/commitdiff
sunvdc: Balance device refcount in vdc_port_mpgroup_check
authorMa Ke <make24@iscas.ac.cn>
Sat, 19 Jul 2025 07:58:56 +0000 (15:58 +0800)
committerJens Axboe <axboe@kernel.dk>
Tue, 22 Jul 2025 16:02:17 +0000 (10:02 -0600)
Using device_find_child() to locate a probed virtual-device-port node
causes a device refcount imbalance, as device_find_child() internally
calls get_device() to increment the device’s reference count before
returning its pointer. vdc_port_mpgroup_check() directly returns true
upon finding a matching device without releasing the reference via
put_device(). We should call put_device() to decrement refcount.

As comment of device_find_child() says, 'NOTE: you will need to drop
the reference with put_device() after use'.

Found by code review.

Cc: stable@vger.kernel.org
Fixes: 3ee70591d6c4 ("sunvdc: prevent sunvdc panic when mpgroup disk added to guest domain")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Link: https://lore.kernel.org/r/20250719075856.3447953-1-make24@iscas.ac.cn
Signed-off-by: Jens Axboe <axboe@kernel.dk>
drivers/block/sunvdc.c

index b5727dea15bde7b9488ae6c4eaf9868a0a83e0b0..7af21fe6767172029c28ae1a1f0d296b3e2278c3 100644 (file)
@@ -957,8 +957,10 @@ static bool vdc_port_mpgroup_check(struct vio_dev *vdev)
        dev = device_find_child(vdev->dev.parent, &port_data,
                                vdc_device_probed);
 
-       if (dev)
+       if (dev) {
+               put_device(dev);
                return true;
+       }
 
        return false;
 }