Re: [PATCH] coresight: fix resource leaks on path build failure

[Jie Gan <jie.gan@oss.qualcomm.com>]

On 11/9/2026 7:46 PM, Suzuki K Poulose wrote:
> On 09/11/2026 10:34, James Clark wrote:
>>
>>
>> On 09/11/2026 01:24, Jie Gan wrote:
>>>
>>>
>>> On 5/13/2026 9:32 AM, Jie Gan wrote:
>>>> Two related leaks when _coresight_build_path() encounters an error 
>>>> after
>>>> coresight_grab_device() has already incremented the pm_runtime, module,
>>>> and device references for a node:
>>>>
>>>> 1. In _coresight_build_path(), if kzalloc_obj() for the path node fails
>>>>     after coresight_grab_device() succeeds, coresight_drop_device() was
>>>>     never called, permanently leaking all three references.
>>>>
>>>> 2. In coresight_build_path(), on failure the partial path was freed 
>>>> with
>>>>     kfree(path) instead of coresight_release_path(path).  kfree() only
>>>>     frees the coresight_path struct itself; it does not iterate 
>>>> path_list
>>>>     to call coresight_drop_device() and kfree() for each coresight_node
>>>>     already added by deeper recursive calls, leaking both the 
>>>> pm_runtime,
>>>>     module, and device references and the node memory for every element
>>>>     on the partial path.
>>>>
>>>> Fix both by adding coresight_drop_device() in the OOM unwind of
>>>> _coresight_build_path(), and replacing kfree(path) with
>>>> coresight_release_path(path) in coresight_build_path().
>>>>
>>>> Fixes: 32b0707a4182 ("coresight: Add try_get_module() in 
>>>> coresight_grab_device()")
>>>> Fixes: b3e94405941e ("coresight: associating path with session 
>>>> rather than tracer")
>>>> Signed-off-by: Jie Gan <jie.gan@oss.qualcomm.com>
>>>
>>> Gentle ping.
>>>
>>>> ---
>>>>   drivers/hwtracing/coresight/coresight-core.c | 6 ++++--
>>>>   1 file changed, 4 insertions(+), 2 deletions(-)
>>>>
>>>> diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/ 
>>>> hwtracing/coresight/coresight-core.c
>>>> index 46f247f73cf6..c1354ea8e11d 100644
>>>> --- a/drivers/hwtracing/coresight/coresight-core.c
>>>> +++ b/drivers/hwtracing/coresight/coresight-core.c
>>>> @@ -825,8 +825,10 @@ static int _coresight_build_path(struct 
>>>> coresight_device *csdev,
>>>>           return ret;
>>>>       node = kzalloc_obj(struct coresight_node);
>>>> -    if (!node)
>>>> +    if (!node) {
>>>> +        coresight_drop_device(csdev);
>>>>           return -ENOMEM;
>>>> +    }
>>>>       node->csdev = csdev;
>>>>       list_add(&node->link, &path->path_list);
>>>> @@ -851,7 +853,7 @@ struct coresight_path 
>>>> *coresight_build_path(struct coresight_device *source,
>>>>       rc = _coresight_build_path(source, source, sink, path);
>>>>       if (rc) {
>>>> -        kfree(path);
>>>> +        coresight_release_path(path);
>>
>> @Suzuki, there's a conflict here. This will need to be 
>> coresight_release_path_locked() if we also take "coresight: etm-perf: 
>> Serialize AUX topology access" from my Sashiko fixes.
> 
> The changes needed by the patch are already what your patches does.
> Apologies Jie Gan, I have merged Jamess series which solves everything.
> So, we can ignore this one.

Got it. Glad to hear the issue to be fixed.

Thanks,
Jie

> 
> Cheers
> Suzuki
>