From a689a10b519f98cd119c5ed8534a851e2a92f197 Mon Sep 17 00:00:00 2001 From: Takashi Sakamoto Date: Thu, 24 Sep 2026 02:23:27 +0900 Subject: [PATCH] firewire: cdev: hold client reference for fw_iso_resource_auto lifetime The fw_iso_resource_auto object can outlive the operation that created it since hte main operation for it is done in a work item. This work and release paths access members of the client structure, therefore the client structure must remain valid for the lifetime of an fw_iso_resource_auto object. Hold a reference to the client structure for the lifetime of the fw_iso_resource_auto object. Link: https://lore.kernel.org/r/20260923172328.277232-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto --- drivers/firewire/core-cdev.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c index 6a2e28b71ba9..0f1415a5eb55 100644 --- a/drivers/firewire/core-cdev.c +++ b/drivers/firewire/core-cdev.c @@ -1397,6 +1397,7 @@ static void iso_resource_auto_work(struct work_struct *work) // xarray and prepare for deletion, unless the client is shutting down. scoped_guard(spinlock_irq, &client->lock) { if (!client->in_shutdown && xa_erase(&client->resource_xa, index)) { + // For the incrementation by add_client_resource(). client_put(client); free = true; } @@ -1438,6 +1439,9 @@ static void iso_resource_auto_work(struct work_struct *work) kfree(r->e_alloc); kfree(r->e_dealloc); kfree(r); + + // For the incrementation by ioctl_allocate_iso_resource(). + client_put(client); } out: client_put(client); @@ -1483,6 +1487,7 @@ static int ioctl_allocate_iso_resource(struct client *client, union ioctl_arg *a if (err < 0) return err; request->handle = r->resource.handle; + client_get(client); retain_and_null_ptr(e1); retain_and_null_ptr(e2);