linux-kernel - [PATCH] perf: arm_cspmu: fix device leak in arm_cspmu_impl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20251027032259.5818-1-make24@iscas.ac.cn>
Date: Mon, 27 Oct 2025 11:22:59 +0800
From: Ma Ke <make24@...as.ac.cn>
To: will@...nel.org,
	mark.rutland@....com,
	james.clark@...aro.org,
	robin.murphy@....com,
	ilkka@...amperecomputing.com,
	make24@...as.ac.cn,
	u.kleine-koenig@...libre.com,
	suzuki.poulose@....com,
	bwicaksono@...dia.com
Cc: linux-arm-kernel@...ts.infradead.org,
	linux-perf-users@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	akpm@...ux-foundation.org,
	stable@...r.kernel.org
Subject: [PATCH] perf: arm_cspmu: fix device leak in arm_cspmu_impl_unregister

arm_cspmu_impl_unregister() utilizes driver_find_device() to locate
matching devices. driver_find_device() increments the ref count of the
found device by calling get_device(), but arm_cspmu_impl_unregister()
fails to call put_device() to decrement the reference count after
processing each device. This results in a reference count leak of the
device objects, which prevents devices from being properly released
and causes a memory leak. Fix the leak by adding put_device() after
device_release_driver() in the while loop.

Found by code review.

Cc: stable@...r.kernel.org
Fixes: bfc653aa89cb ("perf: arm_cspmu: Separate Arm and vendor module")
Signed-off-by: Ma Ke <make24@...as.ac.cn>
---
 drivers/perf/arm_cspmu/arm_cspmu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/perf/arm_cspmu/arm_cspmu.c b/drivers/perf/arm_cspmu/arm_cspmu.c
index efa9b229e701..e0d4293f06f9 100644
--- a/drivers/perf/arm_cspmu/arm_cspmu.c
+++ b/drivers/perf/arm_cspmu/arm_cspmu.c
@@ -1365,8 +1365,10 @@ void arm_cspmu_impl_unregister(const struct arm_cspmu_impl_match *impl_match)
 
 	/* Unbind the driver from all matching backend devices. */
 	while ((dev = driver_find_device(&arm_cspmu_driver.driver, NULL,
-			match, arm_cspmu_match_device)))
+			match, arm_cspmu_match_device))) {
 		device_release_driver(dev);
+		put_device(dev);
+	}
 
 	mutex_lock(&arm_cspmu_lock);
 
-- 
2.17.1