diff options
| author | Ma Ke <make24@iscas.ac.cn> | 2025-07-19 15:58:56 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-08-20 18:30:15 +0200 |
| commit | 0bd77a08d592fa9bd8c9474794fac01d9065de12 (patch) | |
| tree | 0d2be5abe06e6575b617f87c638fdb07dd0f2b10 | |
| parent | facc69f43502c135c16b97d5ded7253f15597912 (diff) | |
sunvdc: Balance device refcount in vdc_port_mpgroup_check
commit 63ce53724637e2e7ba51fe3a4f78351715049905 upstream.
Using device_find_child() to locate a probed virtual-device-port node
causes a device refcount imbalance, as device_find_child() internally
calls get_device() to increment the device’s reference count before
returning its pointer. vdc_port_mpgroup_check() directly returns true
upon finding a matching device without releasing the reference via
put_device(). We should call put_device() to decrement refcount.
As comment of device_find_child() says, 'NOTE: you will need to drop
the reference with put_device() after use'.
Found by code review.
Cc: stable@vger.kernel.org
Fixes: 3ee70591d6c4 ("sunvdc: prevent sunvdc panic when mpgroup disk added to guest domain")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Link: https://lore.kernel.org/r/20250719075856.3447953-1-make24@iscas.ac.cn
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/block/sunvdc.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c index 2d38331ee667..2b249703dc68 100644 --- a/drivers/block/sunvdc.c +++ b/drivers/block/sunvdc.c @@ -957,8 +957,10 @@ static bool vdc_port_mpgroup_check(struct vio_dev *vdev) dev = device_find_child(vdev->dev.parent, &port_data, vdc_device_probed); - if (dev) + if (dev) { + put_device(dev); return true; + } return false; } |