Skip to contentSkip to conversation

FAILED: patch "[PATCH] media: lirc: Fix error handling in lirc_register()" failed to apply to 5.4-stable tree

PATCH New [email protected] 2 participants 3 messages Oct 16, 2025 – Oct 17, 2025

Subsystems (3)
Stable branch Media (V4L/DVB) RC-core / lirc framework
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x 4f4098c57e139ad972154077fb45c3e3141555dd
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2025101607-contend-gentleman-9ae0@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 4f4098c57e139ad972154077fb45c3e3141555dd Mon Sep 17 00:00:00 2001
From: Ma Ke <[email protected]>
Date: Fri, 18 Jul 2025 17:50:54 +0800
Subject: [PATCH] media: lirc: Fix error handling in lirc_register()

When cdev_device_add() failed, calling put_device() to explicitly release dev->lirc_dev. Otherwise, it could cause the fault of the reference count.

Found by code review.

Cc [email protected]
Fixes a6ddd4fecbb0 ("media: lirc: remove last remnants of lirc kapi")
Signed-off-by Ma Ke <[email protected]>
Signed-off-by Sean Young <[email protected]>
Signed-off-by Hans Verkuil <[email protected]>
drivers/media/rc/lirc_dev.c +5 -4
index a2257dc2f25d..7d4942925993 100644
@@ -736,11 +736,11 @@ int lirc_register(struct rc_dev *dev)
 
 	cdev_init(&dev->lirc_cdev, &lirc_fops);
 
+	get_device(&dev->dev);
+
 	err = cdev_device_add(&dev->lirc_cdev, &dev->lirc_dev);
 	if (err)
-		goto out_ida;
-
-	get_device(&dev->dev);
+		goto out_put_device;
 
 	switch (dev->driver_type) {
 	case RC_DRIVER_SCANCODE:

@@ -764,7 +764,8 @@ int lirc_register(struct rc_dev *dev)
 
 	return 0;
 
-out_ida:
+out_put_device:
+	put_device(&dev->lirc_dev);
 	ida_free(&lirc_ida, minor);
 	return err;
 }
maintainer
#1 lore raw

PATCH 1/2 media: rc: Directly use ida_free()

From: keliu <[email protected]>

[ Upstream commit cd54ff938091d890edf78e6555ec30c63dcd2eb5 ]

Use ida_alloc() and ida_free() instead of the deprecated ida_simple_get() and ida_simple_remove().

Signed-off-by keliu <[email protected]>
Signed-off-by Sean Young <[email protected]>
Signed-off-by Mauro Carvalho Chehab <[email protected]>

Stable-dep-of: 4f4098c57e13 ("media: lirc: Fix error handling in lirc_register()")

Signed-off-by Sasha Levin <[email protected]>
---
 drivers/media/rc/lirc_dev.c | 6 +++---
 drivers/media/rc/rc-main.c  | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)
drivers/media/rc/lirc_dev.c +3 -3
index 7de97c26b622a..9c9eac2e1182f 100644
@@ -746,7 +746,7 @@ int ir_lirc_register(struct rc_dev *dev)
 	const char *rx_type, *tx_type;
 	int err, minor;
 
-	minor = ida_simple_get(&lirc_ida, 0, RC_DEV_MAX, GFP_KERNEL);
+	minor = ida_alloc_max(&lirc_ida, RC_DEV_MAX - 1, GFP_KERNEL);
 	if (minor < 0)
 		return minor;
 

@@ -791,7 +791,7 @@ int ir_lirc_register(struct rc_dev *dev)
 	return 0;
 
 out_ida:
-	ida_simple_remove(&lirc_ida, minor);
+	ida_free(&lirc_ida, minor);
 	return err;
 }
 

@@ -809,7 +809,7 @@ void ir_lirc_unregister(struct rc_dev *dev)
 	spin_unlock_irqrestore(&dev->lirc_fh_lock, flags);
 
 	cdev_device_del(&dev->lirc_cdev, &dev->lirc_dev);
-	ida_simple_remove(&lirc_ida, MINOR(dev->lirc_dev.devt));
+	ida_free(&lirc_ida, MINOR(dev->lirc_dev.devt));
 }
 
 int __init lirc_dev_init(void)
drivers/media/rc/rc-main.c +3 -3
index ee80f38970bc4..e5cbe8c50ce1e 100644
@@ -1861,7 +1861,7 @@ int rc_register_device(struct rc_dev *dev)
 	if (!dev)
 		return -EINVAL;
 
-	minor = ida_simple_get(&rc_ida, 0, RC_DEV_MAX, GFP_KERNEL);
+	minor = ida_alloc_max(&rc_ida, RC_DEV_MAX - 1, GFP_KERNEL);
 	if (minor < 0)
 		return minor;
 

@@ -1944,7 +1944,7 @@ int rc_register_device(struct rc_dev *dev)
 out_raw:
 	ir_raw_event_free(dev);
 out_minor:
-	ida_simple_remove(&rc_ida, minor);
+	ida_free(&rc_ida, minor);
 	return rc;
 }
 EXPORT_SYMBOL_GPL(rc_register_device);

@@ -2004,7 +2004,7 @@ void rc_unregister_device(struct rc_dev *dev)
 
 	device_del(&dev->dev);
 
-	ida_simple_remove(&rc_ida, dev->minor);
+	ida_free(&rc_ida, dev->minor);
 
 	if (!dev->managed_alloc)
 		rc_free_device(dev);
Signature · 1 line
2.51.0
maintainer
#2 lore raw

PATCH 2/2 media: lirc: Fix error handling in lirc_register()

From: Ma Ke <[email protected]>

[ Upstream commit 4f4098c57e139ad972154077fb45c3e3141555dd ]

When cdev_device_add() failed, calling put_device() to explicitly release dev->lirc_dev. Otherwise, it could cause the fault of the reference count.

Found by code review.

Cc [email protected]
Fixes a6ddd4fecbb0 ("media: lirc: remove last remnants of lirc kapi")
Signed-off-by Ma Ke <[email protected]>
Signed-off-by Sean Young <[email protected]>
Signed-off-by Hans Verkuil <[email protected]>
Signed-off-by Sasha Levin <[email protected]>
---
 drivers/media/rc/lirc_dev.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/media/rc/lirc_dev.c +5 -4
index 9c9eac2e1182f..aeff7d7155fdf 100644
@@ -762,11 +762,11 @@ int ir_lirc_register(struct rc_dev *dev)
 
 	cdev_init(&dev->lirc_cdev, &lirc_fops);
 
+	get_device(&dev->dev);
+
 	err = cdev_device_add(&dev->lirc_cdev, &dev->lirc_dev);
 	if (err)
-		goto out_ida;
-
-	get_device(&dev->dev);
+		goto out_put_device;
 
 	switch (dev->driver_type) {
 	case RC_DRIVER_SCANCODE:

@@ -790,7 +790,8 @@ int ir_lirc_register(struct rc_dev *dev)
 
 	return 0;
 
-out_ida:
+out_put_device:
+	put_device(&dev->lirc_dev);
 	ida_free(&lirc_ida, minor);
 	return err;
 }
Signature · 1 line
2.51.0