[PATCH] intel_th: Fix error handling in intel_th_output_open

[PATCH] intel_th: Fix error handling in intel_th_output_open

[Ma Ke]

intel_th_output_open() calls bus_find_device_by_devt() which
internally increments the device reference count via get_device(), but
this reference is not properly released in several error paths. When
device driver is unavailable, file operations cannot be obtained, or
the driver's open method fails, the function returns without calling
put_device(), leading to a permanent device reference count leak. This
prevents the device from being properly released and could cause
resource exhaustion over time.

Found by code review.

Cc: stable@vger.kernel.org
Fixes: 39f4034693b7 ("intel_th: Add driver infrastructure for Intel(R) Trace Hub devices")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
---
 drivers/hwtracing/intel_th/core.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
index 47d9e6c3bac0..ecc4b4ff5cf6 100644
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -811,12 +811,12 @@ static int intel_th_output_open(struct inode *inode, struct file *file)
 
 	dev = bus_find_device_by_devt(&intel_th_bus, inode->i_rdev);
 	if (!dev || !dev->driver)
-		return -ENODEV;
+		goto out_no_device;
 
 	thdrv = to_intel_th_driver(dev->driver);
 	fops = fops_get(thdrv->fops);
 	if (!fops)
-		return -ENODEV;
+		goto out_put_device;
 
 	replace_fops(file, fops);
 
@@ -824,10 +824,16 @@ static int intel_th_output_open(struct inode *inode, struct file *file)
 
 	if (file->f_op->open) {
 		err = file->f_op->open(inode, file);
-		return err;
+		if (err)
+			goto out_put_device;
 	}
 
 	return 0;
+
+out_put_device:
+	put_device(dev);
+out_no_device:
+	return err;
 }
 
 static const struct file_operations intel_th_output_fops = {
-- 
2.17.1

Re: [PATCH] intel_th: Fix error handling in intel_th_output_open

[kernel test robot]

Hi Ma,

kernel test robot noticed the following build warnings:

[auto build test WARNING on akpm-mm/mm-everything]
[also build test WARNING on linus/master v6.18-rc5 next-20251111]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Ma-Ke/intel_th-Fix-error-handling-in-intel_th_output_open/20251111-104412
base:   https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-everything
patch link:    https://lore.kernel.org/r/20251111024204.12299-1-make24%40iscas.ac.cn
patch subject: [PATCH] intel_th: Fix error handling in intel_th_output_open
config: x86_64-buildonly-randconfig-002-20251111 (https://download.01.org/0day-ci/archive/20251111/202511112222.vMmKmHbd-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251111/202511112222.vMmKmHbd-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202511112222.vMmKmHbd-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> drivers/hwtracing/intel_th/core.c:818:6: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
     818 |         if (!fops)
         |             ^~~~~
   drivers/hwtracing/intel_th/core.c:836:9: note: uninitialized use occurs here
     836 |         return err;
         |                ^~~
   drivers/hwtracing/intel_th/core.c:818:2: note: remove the 'if' if its condition is always false
     818 |         if (!fops)
         |         ^~~~~~~~~~
     819 |                 goto out_put_device;
         |                 ~~~~~~~~~~~~~~~~~~~
   drivers/hwtracing/intel_th/core.c:813:6: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
     813 |         if (!dev || !dev->driver)
         |             ^~~~~~~~~~~~~~~~~~~~
   drivers/hwtracing/intel_th/core.c:836:9: note: uninitialized use occurs here
     836 |         return err;
         |                ^~~
   drivers/hwtracing/intel_th/core.c:813:2: note: remove the 'if' if its condition is always false
     813 |         if (!dev || !dev->driver)
         |         ^~~~~~~~~~~~~~~~~~~~~~~~~
     814 |                 goto out_no_device;
         |                 ~~~~~~~~~~~~~~~~~~
>> drivers/hwtracing/intel_th/core.c:813:6: warning: variable 'err' is used uninitialized whenever '||' condition is true [-Wsometimes-uninitialized]
     813 |         if (!dev || !dev->driver)
         |             ^~~~
   drivers/hwtracing/intel_th/core.c:836:9: note: uninitialized use occurs here
     836 |         return err;
         |                ^~~
   drivers/hwtracing/intel_th/core.c:813:6: note: remove the '||' if its condition is always false
     813 |         if (!dev || !dev->driver)
         |             ^~~~~~~
   drivers/hwtracing/intel_th/core.c:810:9: note: initialize the variable 'err' to silence this warning
     810 |         int err;
         |                ^
         |                 = 0
   3 warnings generated.


vim +818 drivers/hwtracing/intel_th/core.c

39f4034693b7c7 Alexander Shishkin 2015-09-22  804  
39f4034693b7c7 Alexander Shishkin 2015-09-22  805  static int intel_th_output_open(struct inode *inode, struct file *file)
39f4034693b7c7 Alexander Shishkin 2015-09-22  806  {
39f4034693b7c7 Alexander Shishkin 2015-09-22  807  	const struct file_operations *fops;
39f4034693b7c7 Alexander Shishkin 2015-09-22  808  	struct intel_th_driver *thdrv;
39f4034693b7c7 Alexander Shishkin 2015-09-22  809  	struct device *dev;
39f4034693b7c7 Alexander Shishkin 2015-09-22  810  	int err;
39f4034693b7c7 Alexander Shishkin 2015-09-22  811  
4495dfdd6193d9 Suzuki K Poulose   2019-07-23  812  	dev = bus_find_device_by_devt(&intel_th_bus, inode->i_rdev);
39f4034693b7c7 Alexander Shishkin 2015-09-22 @813  	if (!dev || !dev->driver)
b54f5a424fbe0f Ma Ke              2025-11-11  814  		goto out_no_device;
39f4034693b7c7 Alexander Shishkin 2015-09-22  815  
39f4034693b7c7 Alexander Shishkin 2015-09-22  816  	thdrv = to_intel_th_driver(dev->driver);
39f4034693b7c7 Alexander Shishkin 2015-09-22  817  	fops = fops_get(thdrv->fops);
39f4034693b7c7 Alexander Shishkin 2015-09-22 @818  	if (!fops)
b54f5a424fbe0f Ma Ke              2025-11-11  819  		goto out_put_device;
39f4034693b7c7 Alexander Shishkin 2015-09-22  820  
39f4034693b7c7 Alexander Shishkin 2015-09-22  821  	replace_fops(file, fops);
39f4034693b7c7 Alexander Shishkin 2015-09-22  822  
39f4034693b7c7 Alexander Shishkin 2015-09-22  823  	file->private_data = to_intel_th_device(dev);
39f4034693b7c7 Alexander Shishkin 2015-09-22  824  
39f4034693b7c7 Alexander Shishkin 2015-09-22  825  	if (file->f_op->open) {
39f4034693b7c7 Alexander Shishkin 2015-09-22  826  		err = file->f_op->open(inode, file);
b54f5a424fbe0f Ma Ke              2025-11-11  827  		if (err)
b54f5a424fbe0f Ma Ke              2025-11-11  828  			goto out_put_device;
39f4034693b7c7 Alexander Shishkin 2015-09-22  829  	}
39f4034693b7c7 Alexander Shishkin 2015-09-22  830  
39f4034693b7c7 Alexander Shishkin 2015-09-22  831  	return 0;
b54f5a424fbe0f Ma Ke              2025-11-11  832  
b54f5a424fbe0f Ma Ke              2025-11-11  833  out_put_device:
b54f5a424fbe0f Ma Ke              2025-11-11  834  	put_device(dev);
b54f5a424fbe0f Ma Ke              2025-11-11  835  out_no_device:
b54f5a424fbe0f Ma Ke              2025-11-11 @836  	return err;
39f4034693b7c7 Alexander Shishkin 2015-09-22  837  }
39f4034693b7c7 Alexander Shishkin 2015-09-22  838  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki