media: lirc: Fix error handling in lirc_register()

commit 4f4098c57e139ad972154077fb45c3e3141555dd upstream.

When cdev_device_add() failed, calling put_device() to explicitly
release dev->lirc_dev. Otherwise, it could cause the fault of the
reference count.

Found by code review.

Cc: stable@vger.kernel.org
Fixes: a6ddd4fecbb0 ("media: lirc: remove last remnants of lirc kapi")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/media/rc/lirc_dev.c b/drivers/media/rc/lirc_dev.c
index f042f3f14afa9d788db54735c6b37c64ceb22823..314f64420f62927a0552521b7e59f4e46d3336cb 100644 (file)
--- a/drivers/media/rc/lirc_dev.c
+++ b/drivers/media/rc/lirc_dev.c
@@ -736,11 +736,11 @@ int lirc_register(struct rc_dev *dev)
 
        cdev_init(&dev->lirc_cdev, &lirc_fops);
 
+       get_device(&dev->dev);
+
        err = cdev_device_add(&dev->lirc_cdev, &dev->lirc_dev);
        if (err)
-               goto out_ida;
-
-       get_device(&dev->dev);
+               goto out_put_device;
 
        switch (dev->driver_type) {
        case RC_DRIVER_SCANCODE:
@@ -764,7 +764,8 @@ int lirc_register(struct rc_dev *dev)
 
        return 0;
 
-out_ida:
+out_put_device:
+       put_device(&dev->lirc_dev);
        ida_free(&lirc_ida, minor);
        return err;
 }