linux-kernel - Re: [PATCH] mux: core: fix reference count leak in mux_chip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6f7ebe28-7b93-4e09-ef86-4428d35ada1b@axentia.se>
Date: Sat, 31 Jan 2026 23:03:55 +0100
From: Peter Rosin <peda@...ntia.se>
To: Salah Triki <salah.triki@...il.com>
Cc: linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mux: core: fix reference count leak in
 mux_chip_register()

Hi!

2026-01-31 at 13:09, Salah Triki wrote:
> Once `mux_chip_alloc()` is called, the underlying `struct device` is
> initialized via `device_initialize()`, and its reference count is set
> to 1. Any error path occurring after this point must call `put_device()`
> to ensure proper cleanup of the device and its associated resources.

This patch is broken. NACK.

The put_device() call that you seem to think is missing is found in the
mux_chip_free() function, which is what should be called to clean up
after (a successful) mux_chip_alloc().

If there really is a leak somewhere, the real problem is a missing call
to mux_chip_free(), not a missing put_device() in mux_chip_register().
Adding a put_device() in mux_chip_register() leads to too many calls to
put_device().

Cheers,
Peter