[<prev] [next>] [day] [month] [year] [list]
Message-Id: <20250718095054.3403732-1-make24@iscas.ac.cn>
Date: Fri, 18 Jul 2025 17:50:54 +0800
From: Ma Ke <make24@...as.ac.cn>
To: sean@...s.org,
mchehab@...nel.org
Cc: akpm@...ux-foundation.org,
linux-media@...r.kernel.org,
linux-kernel@...r.kernel.org,
Ma Ke <make24@...as.ac.cn>,
stable@...r.kernel.org
Subject: [PATCH v2] media: lirc: Fix error handling in lirc_register()
When cdev_device_add() failed, calling put_device() to explicitly
release dev->lirc_dev. Otherwise, it could cause the fault of the
reference count.
Found by code review.
Cc: stable@...r.kernel.org
Fixes: a6ddd4fecbb0 ("media: lirc: remove last remnants of lirc kapi")
Signed-off-by: Ma Ke <make24@...as.ac.cn>
---
Changes in v2:
- move get_device() before cdev_device_add() to adjust the timing of parent device reference.
---
drivers/media/rc/lirc_dev.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c
index a2257dc2f25d..7d4942925993 100644
--- a/drivers/media/rc/lirc_dev.c
+++ b/drivers/media/rc/lirc_dev.c
@@ -736,11 +736,11 @@ int lirc_register(struct rc_dev *dev)
cdev_init(&dev->lirc_cdev, &lirc_fops);
+ get_device(&dev->dev);
+
err = cdev_device_add(&dev->lirc_cdev, &dev->lirc_dev);
if (err)
- goto out_ida;
-
- get_device(&dev->dev);
+ goto out_put_device;
switch (dev->driver_type) {
case RC_DRIVER_SCANCODE:
@@ -764,7 +764,8 @@ int lirc_register(struct rc_dev *dev)
return 0;
-out_ida:
+out_put_device:
+ put_device(&dev->lirc_dev);
ida_free(&lirc_ida, minor);
return err;
}
--
2.25.1
Powered by blists - more mailing lists