[PATCH] cpufreq: nforce2: put PCI device on driver register failure

[PATCH] cpufreq: nforce2: put PCI device on driver register failure

[Guangshuo Li]

nforce2_detect_chipset() stores a PCI device returned by
pci_get_subsys() in the global nforce2_dev pointer. That reference is
kept for the lifetime of the loaded module and is released from
nforce2_exit().

However, nforce2_init() gets the PCI device reference before registering
the cpufreq driver. If cpufreq_register_driver() fails, nforce2_init()
returns an error and the module exit path is not run. The reference held
in nforce2_dev is then leaked.

Drop the PCI device reference before returning from the registration
failure path. Clear the global pointer as well so the failed
initialization leaves no stale reference behind.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/cpufreq/cpufreq-nforce2.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/cpufreq/cpufreq-nforce2.c b/drivers/cpufreq/cpufreq-nforce2.c
index 831102522ad6..5a101c69c47a 100644
--- a/drivers/cpufreq/cpufreq-nforce2.c
+++ b/drivers/cpufreq/cpufreq-nforce2.c
@@ -409,6 +409,8 @@ static int nforce2_detect_chipset(void)
  */
 static int __init nforce2_init(void)
 {
+	int ret;
+
 	/* TODO: do we need to detect the processor? */
 
 	/* detect chipset */
@@ -417,7 +419,13 @@ static int __init nforce2_init(void)
 		return -ENODEV;
 	}
 
-	return cpufreq_register_driver(&nforce2_driver);
+	ret = cpufreq_register_driver(&nforce2_driver);
+	if (ret) {
+		pci_dev_put(nforce2_dev);
+		nforce2_dev = NULL;
+	}
+
+	return ret;
 }
 
 /**
-- 
2.43.0

Re: [PATCH] cpufreq: nforce2: put PCI device on driver register failure

[Zhongqiu Han]

On 7/8/2026 7:01 PM, Guangshuo Li wrote:
> nforce2_detect_chipset() stores a PCI device returned by
> pci_get_subsys() in the global nforce2_dev pointer. That reference is
> kept for the lifetime of the loaded module and is released from
> nforce2_exit().
> 
> However, nforce2_init() gets the PCI device reference before registering
> the cpufreq driver. If cpufreq_register_driver() fails, nforce2_init()
> returns an error and the module exit path is not run. The reference held
> in nforce2_dev is then leaked.
> 
> Drop the PCI device reference before returning from the registration
> failure path. Clear the global pointer as well so the failed
> initialization leaves no stale reference behind.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>   drivers/cpufreq/cpufreq-nforce2.c | 10 +++++++++-
>   1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/cpufreq/cpufreq-nforce2.c b/drivers/cpufreq/cpufreq-nforce2.c
> index 831102522ad6..5a101c69c47a 100644
> --- a/drivers/cpufreq/cpufreq-nforce2.c
> +++ b/drivers/cpufreq/cpufreq-nforce2.c
> @@ -409,6 +409,8 @@ static int nforce2_detect_chipset(void)
>    */
>   static int __init nforce2_init(void)
>   {
> +	int ret;
> +
>   	/* TODO: do we need to detect the processor? */
>   
>   	/* detect chipset */
> @@ -417,7 +419,13 @@ static int __init nforce2_init(void)
>   		return -ENODEV;
>   	}
>   
> -	return cpufreq_register_driver(&nforce2_driver);
> +	ret = cpufreq_register_driver(&nforce2_driver);
> +	if (ret) {
> +		pci_dev_put(nforce2_dev);
> +		nforce2_dev = NULL;

nit: setting nforce2_dev to NULL looks redundant here.

Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>


> +	}
> +
> +	return ret;
>   }
>   
>   /**


-- 
Thx and BRs,
Zhongqiu Han