From: Guangshuo Li Date: Mon, 13 Apr 2026 13:46:04 +0000 (+0800) Subject: counter: Fix refcount leak in counter_alloc() error path X-Git-Tag: v7.1-rc6~11^2~10^2 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=d9eeb0ea0d2de658663bfaa9c26eccdd8fd64440;p=thirdparty%2Fkernel%2Fstable.git counter: Fix refcount leak in counter_alloc() error path After device_initialize(), the lifetime of the embedded struct device is expected to be managed through the device core reference counting. In counter_alloc(), if dev_set_name() fails after device_initialize(), the error path removes the chrdev, frees the ID, and frees the backing allocation directly instead of releasing the device reference with put_device(). This bypasses the normal device lifetime rules and may leave the reference count of the embedded struct device unbalanced, resulting in a refcount leak. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix this by using put_device() in the dev_set_name() failure path and let counter_device_release() handle the final cleanup. Fixes: 4da08477ea1f ("counter: Set counter device name") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Link: https://lore.kernel.org/r/20260413134604.2861772-1-lgs201920130244@gmail.com Signed-off-by: William Breathitt Gray --- diff --git a/drivers/counter/counter-core.c b/drivers/counter/counter-core.c index 50bd30ba3d037..0b1dac61b7b56 100644 --- a/drivers/counter/counter-core.c +++ b/drivers/counter/counter-core.c @@ -124,7 +124,8 @@ struct counter_device *counter_alloc(size_t sizeof_priv) err_dev_set_name: - counter_chrdev_remove(counter); + put_device(dev); + return NULL; err_chrdev_add: ida_free(&counter_ida, dev->id);