From: Ma Ke Date: Fri, 17 Oct 2025 23:31:51 +0000 (-0400) Subject: media: lirc: Fix error handling in lirc_register() X-Git-Tag: v5.4.301~71 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=83fc1f68fb82408c9d8d9bece58522d280aaf1f1;p=thirdparty%2Fkernel%2Fstable.git media: lirc: Fix error handling in lirc_register() [ Upstream commit 4f4098c57e139ad972154077fb45c3e3141555dd ] When cdev_device_add() failed, calling put_device() to explicitly release dev->lirc_dev. Otherwise, it could cause the fault of the reference count. Found by code review. Cc: stable@vger.kernel.org Fixes: a6ddd4fecbb0 ("media: lirc: remove last remnants of lirc kapi") Signed-off-by: Ma Ke Signed-off-by: Sean Young Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c index 9c9eac2e1182..aeff7d7155fd 100644 --- a/drivers/media/rc/lirc_dev.c +++ b/drivers/media/rc/lirc_dev.c @@ -762,11 +762,11 @@ int ir_lirc_register(struct rc_dev *dev) cdev_init(&dev->lirc_cdev, &lirc_fops); + get_device(&dev->dev); + err = cdev_device_add(&dev->lirc_cdev, &dev->lirc_dev); if (err) - goto out_ida; - - get_device(&dev->dev); + goto out_put_device; switch (dev->driver_type) { case RC_DRIVER_SCANCODE: @@ -790,7 +790,8 @@ int ir_lirc_register(struct rc_dev *dev) return 0; -out_ida: +out_put_device: + put_device(&dev->lirc_dev); ida_free(&lirc_ida, minor); return err; }