sunvdc: Balance device refcount in vdc_port_mpgroup_check

commit 63ce53724637e2e7ba51fe3a4f78351715049905 upstream.

Using device_find_child() to locate a probed virtual-device-port node
causes a device refcount imbalance, as device_find_child() internally
calls get_device() to increment the device’s reference count before
returning its pointer. vdc_port_mpgroup_check() directly returns true
upon finding a matching device without releasing the reference via
put_device(). We should call put_device() to decrement refcount.

As comment of device_find_child() says, 'NOTE: you will need to drop
the reference with put_device() after use'.

Found by code review.

Cc: stable@vger.kernel.org
Fixes: 3ee70591d6c4 ("sunvdc: prevent sunvdc panic when mpgroup disk added to guest domain")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Link: https://lore.kernel.org/r/20250719075856.3447953-1-make24@iscas.ac.cn
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c
index d9e41d3bbe717044bd68024e1a7487d4ec861300..9cf0b858f7b853d5282ce798bf6ed521b0c7c95b 100644 (file)
--- a/drivers/block/sunvdc.c
+++ b/drivers/block/sunvdc.c
@@ -968,8 +968,10 @@ static bool vdc_port_mpgroup_check(struct vio_dev *vdev)
        dev = device_find_child(vdev->dev.parent, &port_data,
                                vdc_device_probed);
 
-       if (dev)
+       if (dev) {
+               put_device(dev);
                return true;
+       }
 
        return false;
 }