github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation

Browse Source 
mhi_ep_create_device() takes one device reference for the UL channel and
another for the DL channel after allocating the transfer device. These
references are normally released by mhi_ep_destroy_device() before the
device itself is removed.

If dev_set_name() or device_add() fails, the error path currently drops
only one reference. The remaining channel references keep the device
from being released and leave the channels associated with a device that
was never registered.

Route both failures through a common unwind path that drops the DL
channel reference, the UL channel reference, and the initial reference
from device_initialize().

Fixes: 297c77a0f2 ("bus: mhi: ep: Add support for creating and destroying MHI EP devices")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20260603195142.2189386-1-dbgh9129@gmail.com
This commit is contained in:
Yuho Choi 2026-06-03 15:51:42 -04:00 committed by Manivannan Sadhasivam
parent 22568e8f13
commit 6f12862600
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/bus/mhi/ep/main.c
View File

@ -1341,14 +1341,19 @@ static int mhi_ep_create_device(struct mhi_ep_cntrl *mhi_cntrl, u32 ch_id)
ret = dev_set_name(&mhi_dev->dev, "%s_%s",
dev_name(&mhi_cntrl->mhi_dev->dev),
mhi_dev->name);
if (ret) {
put_device(&mhi_dev->dev);
return ret;
}
if (ret)
goto err_put_channels;
ret = device_add(&mhi_dev->dev);
if (ret)
put_device(&mhi_dev->dev);
goto err_put_channels;
return 0;
err_put_channels:
put_device(&mhi_dev->dev); /* DL channel reference */
put_device(&mhi_dev->dev); /* UL channel reference */
put_device(&mhi_dev->dev); /* device_initialize() reference */
return ret;
}