| Message ID | 20241211030803.191789-1-joe@pf.is.s.u-tokyo.ac.jp |
|---|---|
| State | Accepted |
| Delegated to: | Wolfram Sang |
| Headers | show |
| Series | i2c: core: fix reference leak in i2c_register_adapter() | expand |
On Wed, Dec 11, 2024 at 12:08:03PM +0900, Joe Hattori wrote: > The reference count of the device incremented in device_initialize() is > not decremented when device_add() fails. Add a put_device() call before > returning from the function. > > This bug was found by an experimental static analysis tool that I am > developing. > > Fixes: 60f68597024d ("i2c: core: Setup i2c_adapter runtime-pm before calling device_add()") > Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> Applied to for-current, thanks!
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 7c810893bfa3..75d30861ffe2 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1562,6 +1562,7 @@ static int i2c_register_adapter(struct i2c_adapter *adap) res = device_add(&adap->dev); if (res) { pr_err("adapter '%s': can't register device (%d)\n", adap->name, res); + put_device(&adap->dev); goto out_list; }
The reference count of the device incremented in device_initialize() is not decremented when device_add() fails. Add a put_device() call before returning from the function. This bug was found by an experimental static analysis tool that I am developing. Fixes: 60f68597024d ("i2c: core: Setup i2c_adapter runtime-pm before calling device_add()") Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> --- drivers/i2c/i2c-core-base.c | 1 + 1 file changed, 1 insertion(+)