linux-kernel - Re: [PATCH] crypto: hisilicon/qm - Fix device reference leak in qm_get_qos

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <fdcaf975-590e-be7e-40ce-1c8eea75f8ce@huawei.com>
Date: Tue, 28 Oct 2025 09:25:21 +0800
From: liulongfang <liulongfang@...wei.com>
To: Miaoqian Lin <linmq006@...il.com>, Weili Qian <qianweili@...wei.com>, Zhou
 Wang <wangzhou1@...ilicon.com>, Herbert Xu <herbert@...dor.apana.org.au>,
	"David S. Miller" <davem@...emloft.net>, Kai Ye <yekai13@...wei.com>,
	<linux-crypto@...r.kernel.org>, <linux-kernel@...r.kernel.org>
CC: <stable@...r.kernel.org>
Subject: Re: [PATCH] crypto: hisilicon/qm - Fix device reference leak in
 qm_get_qos_value

On 2025/10/27 23:09, Miaoqian Lin wrote:
> The qm_get_qos_value() function calls bus_find_device_by_name() which
> increases the device reference count, but fails to call put_device()
> to balance the reference count and lead to a device reference leak.
> 
> Add put_device() calls in both the error path and success path to
> properly balance the reference count.
> 
> Found via static analysis.
> 
> Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check")
> Cc: stable@...r.kernel.org
> Signed-off-by: Miaoqian Lin <linmq006@...il.com>
> ---
>  drivers/crypto/hisilicon/qm.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
> index a5b96adf2d1e..3b391a146635 100644
> --- a/drivers/crypto/hisilicon/qm.c
> +++ b/drivers/crypto/hisilicon/qm.c
> @@ -3871,10 +3871,12 @@ static ssize_t qm_get_qos_value(struct hisi_qm *qm, const char *buf,
>  	pdev = container_of(dev, struct pci_dev, dev);
>  	if (pci_physfn(pdev) != qm->pdev) {
>  		pci_err(qm->pdev, "the pdev input does not match the pf!\n");
> +		put_device(dev);
>  		return -EINVAL;
>  	}
>  
>  	*fun_index = pdev->devfn;
> +	put_device(dev);
>  
>  	return 0;
>  }
> 

Reviewed-by: Longfang Liu <liulongfang@...wei.com>

Thanks.