On Tue, Oct 12, 2021 at 08:57:22AM +0000, Liu, Yi L wrote: > > + ret = __vfio_group_get_from_iommu(iommu_group); > > + if (ret) > > + goto err_unlock; > > > > - minor = vfio_alloc_group_minor(group); > > - if (minor < 0) { > > - vfio_group_unlock_and_free(group); > > - return ERR_PTR(minor); > > + err = cdev_device_add(&group->cdev, &group->dev); > > + if (err) { > > + ret = ERR_PTR(err); > > + goto err_unlock; > > should this err branch put the vfio_group reference acquired > in above __vfio_group_get_from_iommu(iommu_group);? No, if ret was !NULL then the reference is returned to the caller via the err_unlock This path to cdev_device_add has ret = NULL so there is no reference to put back. Jason