device_add() takes and drops its own reference on every return path, so
the async worker only owns the reference that __nd_device_register()
took with get_device(). The failure branch drops that same reference once
more before the unconditional put_device(), which underflows the refcount
and frees the device while it is still referenced by its creator, as
reported by KASAN for the parent pointer access in this function.
Drop the spurious put_device() from the failure branch.
Fixes: 4d88a97aa9e8c ("libnvdimm, nvdimm: dimm driver and base libnvdimm
device-driver infrastructure")
Cc: [email protected]
Signed-off-by: Wentao Liang <[email protected]>
---
drivers/nvdimm/bus.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 45b7d756e39a..a1f33a03aba8 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -488,10 +488,8 @@ static void nd_async_device_register(void *d,
async_cookie_t cookie)
struct device *dev = d;
struct device *parent = dev->parent;
- if (device_add(dev) != 0) {
+ if (device_add(dev) != 0)
dev_err(dev, "%s: failed\n", __func__);
- put_device(dev);
- }
put_device(dev);
if (parent)
put_device(parent);
--
2.34.1
