Re: [PATCH] intel_th: Fix MSC output device reference leak

[Johan Hovold <johan@kernel.org>]

On Sun, Jul 05, 2026 at 10:41:57PM +0800, Guangshuo Li wrote:
> intel_th_output_open() looks up the output device with
> bus_find_device_by_devt(), which returns the device with a reference that
> must be dropped after use.
> 
> The reference is currently intended to be dropped from
> intel_th_output_release(). However, a successful open replaces
> file->f_op with the output driver's file operations before returning, so
> close runs the output driver's release method rather than
> intel_th_output_release().
> 
> For MSC outputs, close runs intel_th_msc_release(). That release path
> only removes the per-file iterator and does not drop the device
> reference taken by intel_th_output_open(), so every successful MSC open
> leaks one device reference.
> 
> Drop the device reference from intel_th_msc_release(), which is the
> release path that is actually used for MSC output files.

Good catch.

> Fixes: 95fc36a234da ("intel_th: fix device leak on output open()")

This one should also go to stable.

> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/hwtracing/intel_th/msu.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
> index a82cf74f39ad..84d99d7b1d20 100644
> --- a/drivers/hwtracing/intel_th/msu.c
> +++ b/drivers/hwtracing/intel_th/msu.c
> @@ -1490,8 +1490,10 @@ static int intel_th_msc_release(struct inode *inode, struct file *file)
>  {
>  	struct msc_iter *iter = file->private_data;
>  	struct msc *msc = iter->msc;
> +	struct intel_th_device *thdev = msc->thdev;
>  
>  	msc_iter_remove(iter, msc);
> +	put_device(&thdev->dev);
>  
>  	return 0;
>  }

You should also remove the unused release callback from
intel_th_output_fops.

Johan