linux-kernel - Re: [PATCH] MIPS: ralink: Fix refcount leak in ill_acc_of

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAOiHx==cJicn3fYbf+yOfGX1ORZNgBwUNuV-2CNAxmdpn9O5Ww@mail.gmail.com>
Date: Wed, 9 Apr 2025 14:57:24 +0200
From: Jonas Gorski <jonas.gorski@...il.com>
To: Thorsten Blum <thorsten.blum@...ux.dev>
Cc: John Crispin <john@...ozen.org>, Sergio Paracuellos <sergio.paracuellos@...il.com>, 
	Thomas Bogendoerfer <tsbogend@...ha.franken.de>, stable@...r.kernel.org, 
	linux-mips@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] MIPS: ralink: Fix refcount leak in ill_acc_of_setup()

Hi,

On Mon, Apr 7, 2025 at 10:32 AM Thorsten Blum <thorsten.blum@...ux.dev> wrote:
>
> The of_find_device_by_node() function increments the reference count of
> the embedded device, which should be released with put_device() when it
> is no longer needed.
>
> In ill_acc_of_setup(), put_device() is only called on error paths, but
> not on the success path. Fix this by calling put_device() before
> returning successfully.

I would think this is very much deliberate as the device is used as
the priv argument of the registered IRQ handler. AFAIU as long as that
one is live the reference of the device needs to be kept.

Dropping the reference of the device should only be done after
freeing/unregistering the IRQ again, which currently never happens.

Best regards,
Jonas