[PATCH] coresight: drop lookup reference in coresight_get_sink_by_id()

[Suzuki K Poulose]

On 19/05/2026 09:43, Ma Ke wrote:
> bus_find_device() returns a device with its reference count
> incremented. coresight_get_sink_by_id() only uses the returned device
> to find the matching CoreSight sink by id and does not need to
> transfer this lookup reference to its callers.
> 
> Keeping the reference forces callers such as etm_setup_aux() to know
> about the internal lookup implementation and to drop the reference
> themselves. This is error-prone and led to a leaked reference when a
> user-selected sink is used for perf AUX tracing.
> 
> Drop the reference inside coresight_get_sink_by_id() after converting
> the device to the corresponding coresight_device. The CoreSight path
> code takes device references it needs when building/using the path.
> 
> Found by code review.

Thanks for the report. But..


> 
> Signed-off-by: Ma Ke <make24 at iscas.ac.cn>
> Cc: stable at vger.kernel.org
> Fixes: 226443925887 ("coresight: Use event attributes for sink selection")

I would rather drop the reference in the etm_setup_aux, to make sure we
are still dealing with a valid device, that has not been removed under
our feet.

Suzuki



> ---
>   drivers/hwtracing/coresight/coresight-core.c | 15 ++++++++++++++-
>   1 file changed, 14 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
> index 46f247f73cf6..2cca4ed83e2c 100644
> --- a/drivers/hwtracing/coresight/coresight-core.c
> +++ b/drivers/hwtracing/coresight/coresight-core.c
> @@ -624,11 +624,24 @@ static int coresight_sink_by_id(struct device *dev, const void *data)
>   struct coresight_device *coresight_get_sink_by_id(u32 id)
>   {
>   	struct device *dev = NULL;
> +	struct coresight_device *csdev;
>   
>   	dev = bus_find_device(&coresight_bustype, NULL, &id,
>   			      coresight_sink_by_id);
> +	if (!dev)
> +		return NULL;
> +
> +	csdev = to_coresight_device(dev);
> +
> +	/*
> +	 * bus_find_device() returns a device with its reference count
> +	 * incremented. coresight_get_sink_by_id() only performs a lookup;
> +	 * the CoreSight path code takes the references it needs when the
> +	 * path is built, so drop the lookup reference here.
> +	 */
> +	put_device(dev);
>   
> -	return dev ? to_coresight_device(dev) : NULL;
> +	return csdev;
>   }
>   
>   /**