From: Guangshuo Li Date: Mon, 13 Apr 2026 13:53:43 +0000 (+0800) Subject: ACPI: scan: Use acpi_dev_put() in object add error paths X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9c0acc169ac71535477caedea8315f7041c5f07c;p=thirdparty%2Fkernel%2Fstable.git ACPI: scan: Use acpi_dev_put() in object add error paths After acpi_init_device_object(), the lifetime of struct acpi_device is managed by the driver core through reference counting. Both acpi_add_power_resource() and acpi_add_single_object() call acpi_init_device_object() and then invoke acpi_device_add(). If that fails, their error paths call the release callback directly instead of dropping the device reference through acpi_dev_put(). This bypasses the normal device lifetime rules and frees the object without releasing the reference acquired by device_initialize(), which may lead to a refcount leak. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix both error paths by using acpi_dev_put() and let the release callback handle the final cleanup. Fixes: 781d737c7466 ("ACPI: Drop power resources driver") Fixes: 718fb0de8ff88 ("ACPI: fix NULL bug for HID/UID string") Cc: All applicable Signed-off-by: Guangshuo Li Link: https://patch.msgid.link/20260413135343.2884481-1-lgs201920130244@gmail.com Signed-off-by: Rafael J. Wysocki --- diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c index 6b1680ec3694..d4131c184be8 100644 --- a/drivers/acpi/power.c +++ b/drivers/acpi/power.c @@ -987,7 +987,7 @@ struct acpi_device *acpi_add_power_resource(acpi_handle handle) return device; err: - acpi_release_power_resource(&device->dev); + acpi_dev_put(device); return NULL; } diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c index e8cdbdb46fdb..530547cda8b2 100644 --- a/drivers/acpi/scan.c +++ b/drivers/acpi/scan.c @@ -1900,7 +1900,7 @@ static int acpi_add_single_object(struct acpi_device **child, result = acpi_device_add(device); if (result) { - acpi_device_release(&device->dev); + acpi_dev_put(device); return result; }