[PATCH v3 0/2] intel_th: fix device leak on output open()

[PATCH v3 0/2] intel_th: fix device leak on output open()

[Johan Hovold]

This series fixes a device reference leak on output open(), a leak which
was only partially fixed in the upcoming v6.19-rc1.

Included is also a related clean up that switches to a more apt name for
a related error label.

Johan


Changes in v3:
 - rebase on current mainline and commit 6d5925b667e4 ("intel_th: Fix
   error handling in intel_th_output_open") (which fixes a reference
   imbalance in v2)

Changes in v2:
 - drop reference also on the last error path


Johan Hovold (2):
  intel_th: fix device leak on output open()
  intel_th: rename error label

 drivers/hwtracing/intel_th/core.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

-- 
2.52.0

[PATCH v3 1/2] intel_th: fix device leak on output open()

[Johan Hovold]

Make sure to drop the reference taken when looking up the th device
during output device open() on errors and on close().

Note that a recent commit fixed the leak in a couple of open() error
paths but not all of them, and the reference is still leaking on
successful open().

Fixes: 39f4034693b7 ("intel_th: Add driver infrastructure for Intel(R) Trace Hub devices")
Fixes: 6d5925b667e4 ("intel_th: Fix error handling in intel_th_output_open")
Cc: stable@vger.kernel.org	# 4.4: 6d5925b667e4
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ma Ke <make24@iscas.ac.cn>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/hwtracing/intel_th/core.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
index 591b7c12aae5..d9c17214d3dc 100644
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -810,9 +810,12 @@ static int intel_th_output_open(struct inode *inode, struct file *file)
 	int err;
 
 	dev = bus_find_device_by_devt(&intel_th_bus, inode->i_rdev);
-	if (!dev || !dev->driver) {
+	if (!dev)
+		return -ENODEV;
+
+	if (!dev->driver) {
 		err = -ENODEV;
-		goto out_no_device;
+		goto out_put_device;
 	}
 
 	thdrv = to_intel_th_driver(dev->driver);
@@ -836,12 +839,22 @@ static int intel_th_output_open(struct inode *inode, struct file *file)
 
 out_put_device:
 	put_device(dev);
-out_no_device:
+
 	return err;
 }
 
+static int intel_th_output_release(struct inode *inode, struct file *file)
+{
+	struct intel_th_device *thdev = file->private_data;
+
+	put_device(&thdev->dev);
+
+	return 0;
+}
+
 static const struct file_operations intel_th_output_fops = {
 	.open	= intel_th_output_open,
+	.release = intel_th_output_release,
 	.llseek	= noop_llseek,
 };
 
-- 
2.52.0

[PATCH v3 2/2] intel_th: rename error label

[Johan Hovold]

Use a more a descriptive name for the error label that is used to put
the reference to dev.

Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/hwtracing/intel_th/core.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
index d9c17214d3dc..2482ecf5776b 100644
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -815,14 +815,14 @@ static int intel_th_output_open(struct inode *inode, struct file *file)
 
 	if (!dev->driver) {
 		err = -ENODEV;
-		goto out_put_device;
+		goto err_put_dev;
 	}
 
 	thdrv = to_intel_th_driver(dev->driver);
 	fops = fops_get(thdrv->fops);
 	if (!fops) {
 		err = -ENODEV;
-		goto out_put_device;
+		goto err_put_dev;
 	}
 
 	replace_fops(file, fops);
@@ -832,12 +832,12 @@ static int intel_th_output_open(struct inode *inode, struct file *file)
 	if (file->f_op->open) {
 		err = file->f_op->open(inode, file);
 		if (err)
-			goto out_put_device;
+			goto err_put_dev;
 	}
 
 	return 0;
 
-out_put_device:
+err_put_dev:
 	put_device(dev);
 
 	return err;
-- 
2.52.0