[PATCH v3] intel_th: fix MSC output device reference leak

[PATCH v3] intel_th: fix MSC output device reference leak

[Guangshuo Li]

intel_th_output_open() looks up the output device with
bus_find_device_by_devt(), which returns the device with a reference that
must be dropped after use.

commit 95fc36a234da ("intel_th: fix device leak on output open()")
attempted to drop the reference from intel_th_output_release(). However,
a successful open replaces file->f_op with the output driver file
operations before returning, so close runs the output driver release
callback instead.

For MSC outputs, close runs intel_th_msc_release(), which only removes
the per-file iterator and does not drop the device reference taken by
intel_th_output_open(). Consequently, every successful MSC output open
leaks one device reference.

Drop the device reference from intel_th_msc_release(), which is the
release path actually used for MSC output files. Remove the now-unused
intel_th_output_release() callback from intel_th_output_fops.

Fixes: 95fc36a234da ("intel_th: fix device leak on output open()")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
v3:
  - Remove the unused intel_th_output_release() callback as suggested by
    Johan Hovold.

v2:
  - Add Cc stable.
  - No code changes.

 drivers/hwtracing/intel_th/core.c | 10 ----------
 drivers/hwtracing/intel_th/msu.c  |  2 ++
 2 files changed, 2 insertions(+), 10 deletions(-)

diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
index 3924e63e2eee..56acf31546da 100644
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -843,18 +843,8 @@ static int intel_th_output_open(struct inode *inode, struct file *file)
 	return err;
 }
 
-static int intel_th_output_release(struct inode *inode, struct file *file)
-{
-	struct intel_th_device *thdev = file->private_data;
-
-	put_device(&thdev->dev);
-
-	return 0;
-}
-
 static const struct file_operations intel_th_output_fops = {
 	.open	= intel_th_output_open,
-	.release = intel_th_output_release,
 	.llseek	= noop_llseek,
 };
 
diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
index a82cf74f39ad..84d99d7b1d20 100644
--- a/drivers/hwtracing/intel_th/msu.c
+++ b/drivers/hwtracing/intel_th/msu.c
@@ -1490,8 +1490,10 @@ static int intel_th_msc_release(struct inode *inode, struct file *file)
 {
 	struct msc_iter *iter = file->private_data;
 	struct msc *msc = iter->msc;
+	struct intel_th_device *thdev = msc->thdev;
 
 	msc_iter_remove(iter, msc);
+	put_device(&thdev->dev);
 
 	return 0;
 }
-- 
2.43.0

Re: [PATCH v3] intel_th: fix MSC output device reference leak

[Johan Hovold]

On Wed, Jul 15, 2026 at 03:08:51PM +0800, Guangshuo Li wrote:
> intel_th_output_open() looks up the output device with
> bus_find_device_by_devt(), which returns the device with a reference that
> must be dropped after use.
> 
> commit 95fc36a234da ("intel_th: fix device leak on output open()")
> attempted to drop the reference from intel_th_output_release(). However,
> a successful open replaces file->f_op with the output driver file
> operations before returning, so close runs the output driver release
> callback instead.
> 
> For MSC outputs, close runs intel_th_msc_release(), which only removes
> the per-file iterator and does not drop the device reference taken by
> intel_th_output_open(). Consequently, every successful MSC output open
> leaks one device reference.
> 
> Drop the device reference from intel_th_msc_release(), which is the
> release path actually used for MSC output files. Remove the now-unused
> intel_th_output_release() callback from intel_th_output_fops.
> 
> Fixes: 95fc36a234da ("intel_th: fix device leak on output open()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
> v3:
>   - Remove the unused intel_th_output_release() callback as suggested by
>     Johan Hovold.
> 
> v2:
>   - Add Cc stable.
>   - No code changes.

Thanks for catching this.

Reviewed-by: Johan Hovold <johan@kernel.org>

Johan