linux-kernel - Re: [PATCH v2 RESEND] coresight: etm-perf: Fix reference count leak in etm_setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f85c7d37-4980-46f0-9136-353a35a8f0ed@oss.qualcomm.com>
Date: Mon, 15 Dec 2025 18:09:45 +0800
From: Jie Gan <jie.gan@....qualcomm.com>
To: Leo Yan <leo.yan@....com>, James Clark <james.clark@...aro.org>
Cc: Ma Ke <make24@...as.ac.cn>, coresight@...ts.linaro.org,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        akpm@...ux-foundation.org, stable@...r.kernel.org,
        suzuki.poulose@....com, mike.leach@...aro.org,
        alexander.shishkin@...ux.intel.com, mathieu.poirier@...aro.org
Subject: Re: [PATCH v2 RESEND] coresight: etm-perf: Fix reference count leak
 in etm_setup_aux



On 12/15/2025 5:51 PM, Leo Yan wrote:
> On Mon, Dec 15, 2025 at 11:02:08AM +0200, James Clark wrote:
>>
>>
>> On 15/12/2025 04:27, Ma Ke wrote:
>>> In etm_setup_aux(), when a user sink is obtained via
>>> coresight_get_sink_by_id(), it increments the reference count of the
>>> sink device. However, if the sink is used in path building, the path
>>> holds a reference, but the initial reference from
>>> coresight_get_sink_by_id() is not released, causing a reference count
>>> leak. We should release the initial reference after the path is built.
>>>
>>> Found by code review.
>>>
>>> Cc: stable@...r.kernel.org
>>> Fixes: 0e6c20517596 ("coresight: etm-perf: Allow an event to use different sinks")
>>> Signed-off-by: Ma Ke <make24@...as.ac.cn>
>>> ---
>>> Changes in v2:
>>> - modified the patch as suggestions.
>>
>> I think Leo's comment on the previous v2 is still unaddressed. But releasing
>> it in coresight_get_sink_by_id() would make it consistent with
>> coresight_find_csdev_by_fwnode() and prevent further mistakes.
> 
> The point is the coresight core layer uses coresight_grab_device() to
> increase the device's refcnt.  This is why we don't need to grab a
> device when setup AUX.

That make sense. We dont need to hold the refcnt for a while and it 
should be released immediately after locating the required device.

Thanks,
Jie

> 
>> It also leads me to see that users of coresight_find_device_by_fwnode()
>> should also release it, but only one out of two appears to.
> 
> Good finding!
> 
> Thanks,
> Leo
>