d9eeb0ea0d
After device_initialize(), the lifetime of the embedded struct device
is expected to be managed through the device core reference counting.
In counter_alloc(), if dev_set_name() fails after device_initialize(),
the error path removes the chrdev, frees the ID, and frees the backing
allocation directly instead of releasing the device reference with
put_device(). This bypasses the normal device lifetime rules and may
leave the reference count of the embedded struct device unbalanced,
resulting in a refcount leak.
The issue was identified by a static analysis tool I developed and
confirmed by manual review.
Fix this by using put_device() in the dev_set_name() failure path and
let counter_device_release() handle the final cleanup.
Fixes:
|
||
|---|---|---|
| .. | ||
| 104-quad-8.c | ||
| counter-chrdev.c | ||
| counter-chrdev.h | ||
| counter-core.c | ||
| counter-sysfs.c | ||
| counter-sysfs.h | ||
| ftm-quaddec.c | ||
| i8254.c | ||
| intel-qep.c | ||
| interrupt-cnt.c | ||
| Kconfig | ||
| Makefile | ||
| microchip-tcb-capture.c | ||
| rz-mtu3-cnt.c | ||
| stm32-lptimer-cnt.c | ||
| stm32-timer-cnt.c | ||
| ti-ecap-capture.c | ||
| ti-eqep.c | ||