mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-13 07:31:07 +00:00
896df22ee5
firmware_upload_register()
-> fw_create_instance()
-> device_initialize()
After fw_create_instance() succeeds, the lifetime of the embedded struct
device is expected to be managed through the device core reference
counting, since fw_create_instance() has already called
device_initialize().
In firmware_upload_register(), if alloc_lookup_fw_priv() fails after
fw_create_instance() succeeds, the code reaches free_fw_sysfs and frees
fw_sysfs directly instead of releasing the device reference with
put_device(). This may leave the reference count of the embedded struct
device unbalanced, resulting in a refcount leak.
The issue was identified by a static analysis tool I developed and
confirmed by manual review. Fix this by using put_device(fw_dev) in the
failure path and letting fw_dev_release() handle the final cleanup,
instead of freeing the instance directly from the error path.
Fixes:
|
History
|
|
|---|---|---|
| .. | ||
| builtin | ||
| fallback.c | ||
| fallback.h | ||
| fallback_platform.c | ||
| fallback_table.c | ||
| firmware.h | ||
| Kconfig | ||
| main.c | ||
| Makefile | ||
| sysfs.c | ||
| sysfs.h | ||
| sysfs_upload.c | ||
| sysfs_upload.h | ||