[PATCH] intel_th: Fix MSC output device reference leak

[PATCH] intel_th: Fix MSC output device reference leak

[Guangshuo Li]

intel_th_output_open() looks up the output device with
bus_find_device_by_devt(), which returns the device with a reference that
must be dropped after use.

The reference is currently intended to be dropped from
intel_th_output_release(). However, a successful open replaces
file->f_op with the output driver's file operations before returning, so
close runs the output driver's release method rather than
intel_th_output_release().

For MSC outputs, close runs intel_th_msc_release(). That release path
only removes the per-file iterator and does not drop the device
reference taken by intel_th_output_open(), so every successful MSC open
leaks one device reference.

Drop the device reference from intel_th_msc_release(), which is the
release path that is actually used for MSC output files.

Fixes: 95fc36a234da ("intel_th: fix device leak on output open()")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/hwtracing/intel_th/msu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
index a82cf74f39ad..84d99d7b1d20 100644
--- a/drivers/hwtracing/intel_th/msu.c
+++ b/drivers/hwtracing/intel_th/msu.c
@@ -1490,8 +1490,10 @@ static int intel_th_msc_release(struct inode *inode, struct file *file)
 {
 	struct msc_iter *iter = file->private_data;
 	struct msc *msc = iter->msc;
+	struct intel_th_device *thdev = msc->thdev;
 
 	msc_iter_remove(iter, msc);
+	put_device(&thdev->dev);
 
 	return 0;
 }
-- 
2.43.0

Re: [PATCH] intel_th: Fix MSC output device reference leak

[Greg Kroah-Hartman]

On Sun, Jul 05, 2026 at 10:41:57PM +0800, Guangshuo Li wrote:
> intel_th_output_open() looks up the output device with
> bus_find_device_by_devt(), which returns the device with a reference that
> must be dropped after use.
> 
> The reference is currently intended to be dropped from
> intel_th_output_release(). However, a successful open replaces
> file->f_op with the output driver's file operations before returning, so
> close runs the output driver's release method rather than
> intel_th_output_release().
> 
> For MSC outputs, close runs intel_th_msc_release(). That release path
> only removes the per-file iterator and does not drop the device
> reference taken by intel_th_output_open(), so every successful MSC open
> leaks one device reference.
> 
> Drop the device reference from intel_th_msc_release(), which is the
> release path that is actually used for MSC output files.
> 
> Fixes: 95fc36a234da ("intel_th: fix device leak on output open()")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/hwtracing/intel_th/msu.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
> index a82cf74f39ad..84d99d7b1d20 100644
> --- a/drivers/hwtracing/intel_th/msu.c
> +++ b/drivers/hwtracing/intel_th/msu.c
> @@ -1490,8 +1490,10 @@ static int intel_th_msc_release(struct inode *inode, struct file *file)
>  {
>  	struct msc_iter *iter = file->private_data;
>  	struct msc *msc = iter->msc;
> +	struct intel_th_device *thdev = msc->thdev;
>  
>  	msc_iter_remove(iter, msc);
> +	put_device(&thdev->dev);
>  
>  	return 0;
>  }
> -- 
> 2.43.0
> 

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- You have marked a patch with a "Fixes:" tag for a commit that is in an
  older released kernel, yet you do not have a cc: stable line in the
  signed-off-by area at all, which means that the patch will not be
  applied to any older kernel releases.  To properly fix this, please
  follow the documented rules in the
  Documentation/process/stable-kernel-rules.rst file for how to resolve
  this.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot

Re: [PATCH] intel_th: Fix MSC output device reference leak

[Johan Hovold]

On Sun, Jul 05, 2026 at 10:41:57PM +0800, Guangshuo Li wrote:
> intel_th_output_open() looks up the output device with
> bus_find_device_by_devt(), which returns the device with a reference that
> must be dropped after use.
> 
> The reference is currently intended to be dropped from
> intel_th_output_release(). However, a successful open replaces
> file->f_op with the output driver's file operations before returning, so
> close runs the output driver's release method rather than
> intel_th_output_release().
> 
> For MSC outputs, close runs intel_th_msc_release(). That release path
> only removes the per-file iterator and does not drop the device
> reference taken by intel_th_output_open(), so every successful MSC open
> leaks one device reference.
> 
> Drop the device reference from intel_th_msc_release(), which is the
> release path that is actually used for MSC output files.

Good catch.

> Fixes: 95fc36a234da ("intel_th: fix device leak on output open()")

This one should also go to stable.

> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/hwtracing/intel_th/msu.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
> index a82cf74f39ad..84d99d7b1d20 100644
> --- a/drivers/hwtracing/intel_th/msu.c
> +++ b/drivers/hwtracing/intel_th/msu.c
> @@ -1490,8 +1490,10 @@ static int intel_th_msc_release(struct inode *inode, struct file *file)
>  {
>  	struct msc_iter *iter = file->private_data;
>  	struct msc *msc = iter->msc;
> +	struct intel_th_device *thdev = msc->thdev;
>  
>  	msc_iter_remove(iter, msc);
> +	put_device(&thdev->dev);
>  
>  	return 0;
>  }

You should also remove the unused release callback from
intel_th_output_fops.

Johan