fsi_master_aspeed_probe() takes an extra reference to master.dev with
get_device() after registering the FSI master so that the aspeed object
remains valid while the remove path performs its cleanup.
However, fsi_master_aspeed_remove() never drops this extra reference.
After fsi_master_unregister() releases the reference held by device
registration, the extra reference remains and prevents the device
release callback from being invoked. As a result,
aspeed_master_release() is never called and the fsi_master_aspeed
object is leaked.
Drop the extra device reference with put_device() after the clock has
been disabled. This allows the reference count to reach zero and
aspeed_master_release() to free the aspeed object.
This issue was found by manual code inspection.
Fixes: 606397d67f41 ("fsi: Add ast2600 master driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <redacted>
---
drivers/fsi/fsi-master-aspeed.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/fsi/fsi-master-aspeed.c b/drivers/fsi/fsi-master-aspeed.c
index aa1380cdff33..d21d06b44350 100644
--- a/drivers/fsi/fsi-master-aspeed.c
+++ b/drivers/fsi/fsi-master-aspeed.c
@@ -652,6 +652,7 @@ static void fsi_master_aspeed_remove(struct platform_device *pdev)
fsi_master_unregister(&aspeed->master);
clk_disable_unprepare(aspeed->clk);
+ put_device(&aspeed->master.dev);
}
static const struct of_device_id fsi_master_aspeed_match[] = {--
2.43.0