[PATCH] comedi: comedi_bond: Fix leak of opened device references

[PATCH] comedi: comedi_bond: Fix leak of opened device references

[Ian Abbott]

bonding_attach() calls do_dev_config() to open other comedi devices
specified by the user and tries to make use of them as part of the
'bonding' device.  If it successfully opens the other device but cannot
use it (either because it does not any subdevices of a type the
'bonding' device can use, or because of some error that occurs while
dealing with its subdevices) then it is left in the open state and the
fact that it is open does not get recorded by the 'bonding' device, so
the reference to the opened device gets lost.  Fix it by closing the
opened device if it could not be bound to the 'bonding' device.

To match previous behavior, if the opened device is unsuitable then
ignore it (after closing it).  The opened devices recorded by the
'bonding' device will eventually get closed by bonding_detach() even if
bonding_attach() returns an error.

Fixes: 3cf840f65ad5 ("Staging: comedi: add comedi_bond driver")
Reported-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://lore.kernel.org/lkml/20261103063301.1025860-1-vulab@iscas.ac.cn
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---
 drivers/comedi/drivers/comedi_bond.c | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/drivers/comedi/drivers/comedi_bond.c b/drivers/comedi/drivers/comedi_bond.c
index a10cfbd04c728..3764ece90f826 100644
--- a/drivers/comedi/drivers/comedi_bond.c
+++ b/drivers/comedi/drivers/comedi_bond.c
@@ -184,7 +184,9 @@ static int do_dev_config(struct comedi_device *dev, struct comedi_devconfig *it)
 		char file[sizeof("/dev/comediXXXXXX")];
 		int minor = it->options[i];
 		struct comedi_device *d;
-		int sdev = -1, nchans;
+		int sdev = -1;
+		int nchans;
+		int nope = 1;
 		struct bonded_device *bdev;
 		struct bonded_device **devs;
 
@@ -223,11 +225,14 @@ static int do_dev_config(struct comedi_device *dev, struct comedi_devconfig *it)
 				dev_err(dev->class_dev,
 					"comedi_get_n_channels() returned %d on minor %u subdev %d!\n",
 					nchans, minor, sdev);
-				return -EINVAL;
+				nope = -EINVAL;
+				break;
 			}
 			bdev = kmalloc_obj(*bdev);
-			if (!bdev)
-				return -ENOMEM;
+			if (!bdev) {
+				nope = -ENOMEM;
+				break;
+			}
 
 			bdev->dev = d;
 			bdev->minor = minor;
@@ -248,14 +253,23 @@ static int do_dev_config(struct comedi_device *dev, struct comedi_devconfig *it)
 				dev_err(dev->class_dev,
 					"Could not allocate memory. Out of memory?\n");
 				kfree(bdev);
-				return -ENOMEM;
+				nope = -ENOMEM;
+				break;
 			}
 			devpriv->devs = devs;
 			devpriv->devs[devpriv->ndevs++] = bdev;
+			nope = 0;	/* keeps the device open */
 
 			/* Append dev:subdev to devpriv->name */
 			seq_buf_printf(&s, "%u:%u ", bdev->minor, bdev->subdev);
 		}
+
+		if (nope) {
+			/* Opened device cannot be used, so close it. */
+			comedi_close_from(d, dev->minor);
+			if (nope < 0)
+				return nope;
+		}
 	}
 
 	if (!devpriv->nchans) {
-- 
2.53.0

Re: [PATCH] comedi: comedi_bond: Fix leak of opened device references

[Greg Kroah-Hartman]

On Tue, Nov 03, 2026 at 05:36:10PM +0000, Ian Abbott wrote:
> bonding_attach() calls do_dev_config() to open other comedi devices
> specified by the user and tries to make use of them as part of the
> 'bonding' device.  If it successfully opens the other device but cannot
> use it (either because it does not any subdevices of a type the
> 'bonding' device can use, or because of some error that occurs while
> dealing with its subdevices) then it is left in the open state and the
> fact that it is open does not get recorded by the 'bonding' device, so
> the reference to the opened device gets lost.  Fix it by closing the
> opened device if it could not be bound to the 'bonding' device.
> 
> To match previous behavior, if the opened device is unsuitable then
> ignore it (after closing it).  The opened devices recorded by the
> 'bonding' device will eventually get closed by bonding_detach() even if
> bonding_attach() returns an error.
> 
> Fixes: 3cf840f65ad5 ("Staging: comedi: add comedi_bond driver")
> Reported-by: Wentao Liang <vulab@iscas.ac.cn>

This is a known bot.  I'll be glad to take this patch if you redo it
from you and that you take the authorship.  As-is, I can't take it from
this fake "author", sorry.

greg k-h

Re: [PATCH] comedi: comedi_bond: Fix leak of opened device references

[Ian Abbott]

On 04/11/2026 12:59, Greg Kroah-Hartman wrote:
> On Tue, Nov 03, 2026 at 05:36:10PM +0000, Ian Abbott wrote:
>> bonding_attach() calls do_dev_config() to open other comedi devices
>> specified by the user and tries to make use of them as part of the
>> 'bonding' device.  If it successfully opens the other device but cannot
>> use it (either because it does not any subdevices of a type the
>> 'bonding' device can use, or because of some error that occurs while
>> dealing with its subdevices) then it is left in the open state and the
>> fact that it is open does not get recorded by the 'bonding' device, so
>> the reference to the opened device gets lost.  Fix it by closing the
>> opened device if it could not be bound to the 'bonding' device.
>>
>> To match previous behavior, if the opened device is unsuitable then
>> ignore it (after closing it).  The opened devices recorded by the
>> 'bonding' device will eventually get closed by bonding_detach() even if
>> bonding_attach() returns an error.
>>
>> Fixes: 3cf840f65ad5 ("Staging: comedi: add comedi_bond driver")
>> Reported-by: Wentao Liang <vulab@iscas.ac.cn>
> 
> This is a known bot.  I'll be glad to take this patch if you redo it
> from you and that you take the authorship.  As-is, I can't take it from
> this fake "author", sorry.
> 
> greg k-h

Actually, I did redo it in a completely different way to the original 
patch.  I just used the original patch as a bug report.  Should I remove 
just the "Reported-by:" line, or should I also remove the "Link:" to the 
original patch from the bot?

Cheers,
Ian

-- 
-=( Ian Abbott <abbotti@mev.co.uk> || MEV Ltd. is a company  )=-
-=( registered in England & Wales.  Regd. number: 02862268.  )=-
-=( Regd. addr.: S11 & 12 Building 67, Europa Business Park, )=-
-=( Bird Hall Lane, STOCKPORT, SK3 0XA, UK. || www.mev.co.uk )=-

Re: [PATCH] comedi: comedi_bond: Fix leak of opened device references

[Greg Kroah-Hartman]

On Wed, Nov 04, 2026 at 02:00:17PM +0000, Ian Abbott wrote:
> On 04/11/2026 12:59, Greg Kroah-Hartman wrote:
> > On Tue, Nov 03, 2026 at 05:36:10PM +0000, Ian Abbott wrote:
> > > bonding_attach() calls do_dev_config() to open other comedi devices
> > > specified by the user and tries to make use of them as part of the
> > > 'bonding' device.  If it successfully opens the other device but cannot
> > > use it (either because it does not any subdevices of a type the
> > > 'bonding' device can use, or because of some error that occurs while
> > > dealing with its subdevices) then it is left in the open state and the
> > > fact that it is open does not get recorded by the 'bonding' device, so
> > > the reference to the opened device gets lost.  Fix it by closing the
> > > opened device if it could not be bound to the 'bonding' device.
> > > 
> > > To match previous behavior, if the opened device is unsuitable then
> > > ignore it (after closing it).  The opened devices recorded by the
> > > 'bonding' device will eventually get closed by bonding_detach() even if
> > > bonding_attach() returns an error.
> > > 
> > > Fixes: 3cf840f65ad5 ("Staging: comedi: add comedi_bond driver")
> > > Reported-by: Wentao Liang <vulab@iscas.ac.cn>
> > 
> > This is a known bot.  I'll be glad to take this patch if you redo it
> > from you and that you take the authorship.  As-is, I can't take it from
> > this fake "author", sorry.
> > 
> > greg k-h
> 
> Actually, I did redo it in a completely different way to the original patch.
> I just used the original patch as a bug report.  Should I remove just the
> "Reported-by:" line, or should I also remove the "Link:" to the original
> patch from the bot?

Ah crap, I missed that this was reported-by and not the author.  I'll go
take this as-is, my fault, sorry for the noise.

greg k-h