bonding_detach() closes devices by walking the bonded subdevice array. If a device has no digital I/O subdevices, do_dev_config() never adds it to that array. Its open reference is then lost. The same happens if configuration fails before the first subdevice entry for a device has been added, for example when allocating that entry fails. Keep the device returned by each successful comedi_open_from() in a separate array indexed by the configuration option. Close those devices on detach, including attach failure cleanup. This also removes the need to deduplicate closes for devices with multiple bonded subdevices. Fixes: 3cf840f65ad5 ("Staging: comedi: add comedi_bond driver") Cc: stable@vger.kernel.org Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex Signed-off-by: Wentao Liang --- drivers/comedi/drivers/comedi_bond.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/comedi/drivers/comedi_bond.c b/drivers/comedi/drivers/comedi_bond.c index a10cfbd04c72..ac8937550ce9 100644 --- a/drivers/comedi/drivers/comedi_bond.c +++ b/drivers/comedi/drivers/comedi_bond.c @@ -55,6 +55,7 @@ struct bonded_device { struct comedi_bond_private { char name[256]; struct bonded_device **devs; + struct comedi_device *opened_devs[COMEDI_NDEVCONFOPTS]; unsigned int ndevs; unsigned int nchans; }; @@ -215,6 +216,8 @@ static int do_dev_config(struct comedi_device *dev, struct comedi_devconfig *it) return -ENODEV; } + devpriv->opened_devs[i] = d; + /* Do DIO, as that's all we support now.. */ while ((sdev = comedi_find_subdevice_by_type(d, COMEDI_SUBD_DIO, sdev + 1)) > -1) { @@ -312,24 +315,28 @@ static int bonding_attach(struct comedi_device *dev, static void bonding_detach(struct comedi_device *dev) { struct comedi_bond_private *devpriv = dev->private; + unsigned int i; - if (devpriv && devpriv->devs) { - DECLARE_BITMAP(devs_closed, COMEDI_NUM_BOARD_MINORS); + if (!devpriv) + return; - memset(&devs_closed, 0, sizeof(devs_closed)); + if (devpriv->devs) { while (devpriv->ndevs--) { struct bonded_device *bdev; bdev = devpriv->devs[devpriv->ndevs]; if (!bdev) continue; - if (!test_and_set_bit(bdev->minor, devs_closed)) - comedi_close_from(bdev->dev, dev->minor); kfree(bdev); } kfree(devpriv->devs); devpriv->devs = NULL; } + + for (i = 0; i < ARRAY_SIZE(devpriv->opened_devs); i++) { + if (devpriv->opened_devs[i]) + comedi_close_from(devpriv->opened_devs[i], dev->minor); + } } static struct comedi_driver bonding_driver = { -- 2.34.1