From 6793764f47a7f7ccd54ac20581293c3c2498f775 Mon Sep 17 00:00:00 2001
From: dujunbao <14829755+du-junbao@user.noreply.gitee.com>
Date: Tue, 22 Sep 2026 21:07:56 +0800
Subject: [PATCH] urma: uburma: fix uobj reference leak on free token id check
 failure

uobj_get_del() looks up the token uobject and takes a reference to it
(kref_get_unless_zero()). free_token_id then validates the token id
carried by the command against the one stored in the uobject.

If the two do not match, the command returns -EPERM right away, without
dropping the reference taken by the lookup. The extra reference keeps the
uobject from ever reaching refcount zero, so uobj_free() is never
reached: the uobject, the ubcore token id it wraps and its IDR entry stay
allocated for the lifetime of the file, and every rejected request leaks
another one.

The other UOBJ_CLASS_TOKEN removal path and all sibling lookup-and-delete
commands release the reference on every exit path; do the same here.

Fixes: 5d0008e6df2c ("uburma: implement comprehensive jetty linking and transport features")
---
 drivers/ub/urma/uburma/uburma_cmd.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/ub/urma/uburma/uburma_cmd.c b/drivers/ub/urma/uburma/uburma_cmd.c
index fea2eb127663..9a052c71e2c7 100644
--- a/drivers/ub/urma/uburma/uburma_cmd.c
+++ b/drivers/ub/urma/uburma/uburma_cmd.c
@@ -193,8 +193,10 @@ static int uburma_cmd_free_token_id(struct ubcore_device *ubc_dev,
 	}
 
 	token = (struct ubcore_token_id *)uobj->object;
-	if (arg.in.token_id != token->token_id)
+	if (arg.in.token_id != token->token_id) {
+		uobj_put_del(uobj);
 		return -EPERM;
+	}
 
 	ret = uobj_remove_commit(uobj);
 	if (ret != 0)
-- 
Gitee