linux-kernel - RE: [PATCH] mei: Fix error handling in mei

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CY5PR11MB6366D9CA2C95D23DD1BF3D9BEDCEA@CY5PR11MB6366.namprd11.prod.outlook.com>
Date: Mon, 10 Nov 2025 11:31:54 +0000
From: "Usyskin, Alexander" <alexander.usyskin@...el.com>
To: Ma Ke <make24@...as.ac.cn>, "arnd@...db.de" <arnd@...db.de>,
	"gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
CC: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"akpm@...ux-foundation.org" <akpm@...ux-foundation.org>,
	"stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: RE: [PATCH] mei: Fix error handling in mei_register

> Subject: [PATCH] mei: Fix error handling in mei_register
> 
> mei_register() fails to release the device reference in error paths
> after device_initialize(). During normal device registration, the
> reference is properly handled through mei_deregister() which calls
> device_destroy(). However, in error handling paths (such as cdev_alloc
> failure, cdev_add failure, etc.), missing put_device() calls cause
> reference count leaks, preventing the device's release function
> (mei_device_release) from being called and resulting in memory leaks
> of mei_device.
> 
> Found by code review.
> 

Nice catch.
Acked-by: Alexander Usyskin <alexander.usyskin@...el.com>

> Cc: stable@...r.kernel.org
> Fixes: 7704e6be4ed2 ("mei: hook mei_device on class device")
> Signed-off-by: Ma Ke <make24@...as.ac.cn>
> ---
>  drivers/misc/mei/main.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
> index 86a73684a373..6f26d5160788 100644
> --- a/drivers/misc/mei/main.c
> +++ b/drivers/misc/mei/main.c
> @@ -1307,6 +1307,7 @@ int mei_register(struct mei_device *dev, struct
> device *parent)
>  err_del_cdev:
>  	cdev_del(dev->cdev);
>  err:
> +	put_device(&dev->dev);
>  	mei_minor_free(minor);
>  	return ret;
>  }
> --
> 2.17.1