Skip to contentSkip to conversation

cpufreq: nforce2: fix reference count leak in nforce2

PATCH Applied Miaoqian Lin 2 participants 2 messages Oct 27, 2025 – Oct 28, 2025

Subsystems (2)
Stable branch CPU frequency scaling framework
lore
Share & tools
lore

Miaoqian Lin

author
#0 lore raw

PATCH 1/1 cpufreq: nforce2: fix reference count leak in nforce2

There are two reference count leaks in this driver:

1. In nforce2_fsb_read(): pci_get_subsys() increases the reference count of the PCI device, but pci_dev_put() is never called to release it, thus leaking the reference.

2. In nforce2_detect_chipset(): pci_get_subsys() gets a reference to the nforce2_dev which is stored in a global variable, but the reference is never released when the module is unloaded.

Fix both by:
- Adding pci_dev_put(nforce2_sub5) in nforce2_fsb_read() after reading the configuration.
- Adding pci_dev_put(nforce2_dev) in nforce2_exit() to release the global device reference.

Found via static analysis.

Fixes 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc [email protected]
Signed-off-by Miaoqian Lin <[email protected]>
---
 drivers/cpufreq/cpufreq-nforce2.c | 3 +++
 1 file changed, 3 insertions(+)
drivers/cpufreq/cpufreq-nforce2.c +3 -0
index fedad1081973..fbbbe501cf2d 100644
@@ -145,6 +145,8 @@ static unsigned int nforce2_fsb_read(int bootfsb)
 	pci_read_config_dword(nforce2_sub5, NFORCE2_BOOTFSB, &fsb);
 	fsb /= 1000000;
 
+	pci_dev_put(nforce2_sub5);
+
 	/* Check if PLL register is already set */
 	pci_read_config_byte(nforce2_dev, NFORCE2_PLLENABLE, (u8 *)&temp);
 

@@ -426,6 +428,7 @@ static int __init nforce2_init(void)
 static void __exit nforce2_exit(void)
 {
 	cpufreq_unregister_driver(&nforce2_driver);
+	pci_dev_put(nforce2_dev);
 }
 
 module_init(nforce2_init);
Signature · 1 line
2.39.5 (Apple Git-154)
maintainer Applied
#1 lore raw
Quoted 16 lines · Miaoqian Lin

There are two reference count leaks in this driver:

1. In nforce2_fsb_read(): pci_get_subsys() increases the reference count of the PCI device, but pci_dev_put() is never called to release it, thus leaking the reference.

2. In nforce2_detect_chipset(): pci_get_subsys() gets a reference to the nforce2_dev which is stored in a global variable, but the reference is never released when the module is unloaded.

Fix both by:
- Adding pci_dev_put(nforce2_sub5) in nforce2_fsb_read() after reading the configuration.
- Adding pci_dev_put(nforce2_dev) in nforce2_exit() to release the global device reference.

Quoted 8 lines

Found via static analysis.

Fixes 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc [email protected]
Signed-off-by Miaoqian Lin <[email protected]>
---
 drivers/cpufreq/cpufreq-nforce2.c | 3 +++
 1 file changed, 3 insertions(+)

Applied. Thanks.

Signature · 1 line
viresh