On 7/8/2026 7:01 PM, Guangshuo Li wrote:
> nforce2_detect_chipset() stores a PCI device returned by
> pci_get_subsys() in the global nforce2_dev pointer. That reference is
> kept for the lifetime of the loaded module and is released from
> nforce2_exit().
> 
> However, nforce2_init() gets the PCI device reference before registering
> the cpufreq driver. If cpufreq_register_driver() fails, nforce2_init()
> returns an error and the module exit path is not run. The reference held
> in nforce2_dev is then leaked.
> 
> Drop the PCI device reference before returning from the registration
> failure path. Clear the global pointer as well so the failed
> initialization leaves no stale reference behind.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>   drivers/cpufreq/cpufreq-nforce2.c | 10 +++++++++-
>   1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/cpufreq/cpufreq-nforce2.c b/drivers/cpufreq/cpufreq-nforce2.c
> index 831102522ad6..5a101c69c47a 100644
> --- a/drivers/cpufreq/cpufreq-nforce2.c
> +++ b/drivers/cpufreq/cpufreq-nforce2.c
> @@ -409,6 +409,8 @@ static int nforce2_detect_chipset(void)
>    */
>   static int __init nforce2_init(void)
>   {
> +	int ret;
> +
>   	/* TODO: do we need to detect the processor? */
> 
>   	/* detect chipset */
> @@ -417,7 +419,13 @@ static int __init nforce2_init(void)
>   		return -ENODEV;
>   	}
> 
> -	return cpufreq_register_driver(&nforce2_driver);
> +	ret = cpufreq_register_driver(&nforce2_driver);
> +	if (ret) {
> +		pci_dev_put(nforce2_dev);
> +		nforce2_dev = NULL;

nit: setting nforce2_dev to NULL looks redundant here.

Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>


> +	}
> +
> +	return ret;
>   }
> 
>   /**


-- 
Thx and BRs,
Zhongqiu Han