From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 204AA30C142 for ; Mon, 6 Jul 2026 07:28:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783322906; cv=none; b=AEgekIc+sCQ2qxg/nrRuEbRFiz58FKcdNrEbhwo1xrr0Er7QnvUCRmohP75lZjsSUmQGRnmwwdXyA+FeXRJRRV8K/tXxdXZFC4Bk6vX4tG+QiKBUVgR9bYcfluKBstgQT+9ZmJtazyZI/s/bWV3YJBtOwvJ9qv09tnMPYKypYdY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783322906; c=relaxed/simple; bh=Hm28dxo8t2+gpQDI5X6cbhiEpNumeF764kSx3vtwQnw=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=BuJ5jzHy2t3BvkFMkQP1XFEszHd+OM9AS/ZoTwhTKnKV7nbiCUzsiA7yXpgyVs6wH4/mZoVmoe+vaNu9BDIs6hsarra3AdwZEDtqiVK/nUWUEssJEuDi7QEXhvp9MI+d1ogEq2G4rNWpS9dOHa/iPQlO8Jy69bo6AuSinbemWrc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=drC+4dpT; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="drC+4dpT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 23B751F000E9; Mon, 6 Jul 2026 07:28:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1783322894; bh=9u+Bkj0vZIBqCqYzdGcJDT2A6vcJXV9xH8yGE0/5GZ4=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=drC+4dpTRyyjejxR7DmBscKLcfjJnwLJFuU0tjrgXkx+joQ3b12xDxrKZzJZ85fFA bFXD+rEuk4LFyh8v1VPxttACf3MRGl6t2AVSnS1Hay/FxnXvou+C2GUmPb+B2b8nyT D1Ud2+Q0vKmERFLMx+pVYWA3TAW1bTeAZqkU4emVyX8BmZy5Yq9sl8ZxSrH2sTyNnE omPbhcRX7vjk4REsmQ82Ho8jBRvFoD9chMHWgCGmTQ+Vgpd1LP64KcMQgafW2N0HRg 4qi4Wfda8W8sV9J+yVs/ATtuK2yy5AP5Kds3xPOOtDbCovZstp6b2E/M4gN7KVfDTg 3z0XD63m3EqPw== Received: from johan by xi.lan with local (Exim 4.99.4) (envelope-from ) id 1wgdkS-00000001mjm-0Bqe; Mon, 06 Jul 2026 09:28:12 +0200 Date: Mon, 6 Jul 2026 09:28:12 +0200 From: Johan Hovold To: Guangshuo Li Cc: Alexander Shishkin , Greg Kroah-Hartman , linux-kernel@vger.kernel.org Subject: Re: [PATCH] intel_th: Fix MSC output device reference leak Message-ID: References: <20260705144157.289303-1-lgs201920130244@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260705144157.289303-1-lgs201920130244@gmail.com> On Sun, Jul 05, 2026 at 10:41:57PM +0800, Guangshuo Li wrote: > intel_th_output_open() looks up the output device with > bus_find_device_by_devt(), which returns the device with a reference that > must be dropped after use. > > The reference is currently intended to be dropped from > intel_th_output_release(). However, a successful open replaces > file->f_op with the output driver's file operations before returning, so > close runs the output driver's release method rather than > intel_th_output_release(). > > For MSC outputs, close runs intel_th_msc_release(). That release path > only removes the per-file iterator and does not drop the device > reference taken by intel_th_output_open(), so every successful MSC open > leaks one device reference. > > Drop the device reference from intel_th_msc_release(), which is the > release path that is actually used for MSC output files. Good catch. > Fixes: 95fc36a234da ("intel_th: fix device leak on output open()") This one should also go to stable. > Signed-off-by: Guangshuo Li > --- > drivers/hwtracing/intel_th/msu.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c > index a82cf74f39ad..84d99d7b1d20 100644 > --- a/drivers/hwtracing/intel_th/msu.c > +++ b/drivers/hwtracing/intel_th/msu.c > @@ -1490,8 +1490,10 @@ static int intel_th_msc_release(struct inode *inode, struct file *file) > { > struct msc_iter *iter = file->private_data; > struct msc *msc = iter->msc; > + struct intel_th_device *thdev = msc->thdev; > > msc_iter_remove(iter, msc); > + put_device(&thdev->dev); > > return 0; > } You should also remove the unused release callback from intel_th_output_fops. Johan