net: ipa: fix SMEM state handle leaks in SMP2P init

ipa_smp2p_init() acquires two Qualcomm SMEM state handles with
qcom_smem_state_get(). However, neither the init error paths
nor ipa_smp2p_exit() release them.

Release both handles with qcom_smem_state_put() in the init
error paths and in ipa_smp2p_exit().

Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com>
Reviewed-by: Alex Elder <elder@riscstar.com>
Link: https://patch.msgid.link/20260624065955.2822765-1-haoxiang_li2024@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c
index 2f0ccdd937ccbe808829cbfc6215d24b4b2ec5a0..331c00ad02c054f7b96c94307d89e0ce873254bc 100644 (file)
--- a/drivers/net/ipa/ipa_smp2p.c
+++ b/drivers/net/ipa/ipa_smp2p.c
@@ -232,19 +232,27 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
                                          &valid_bit);
        if (IS_ERR(valid_state))
                return PTR_ERR(valid_state);
-       if (valid_bit >= 32)            /* BITS_PER_U32 */
-               return -EINVAL;
+       if (valid_bit >= 32) {          /* BITS_PER_U32 */
+               ret = -EINVAL;
+               goto err_valid_state_put;
+       }
 
        enabled_state = qcom_smem_state_get(dev, "ipa-clock-enabled",
                                            &enabled_bit);
-       if (IS_ERR(enabled_state))
-               return PTR_ERR(enabled_state);
-       if (enabled_bit >= 32)          /* BITS_PER_U32 */
-               return -EINVAL;
+       if (IS_ERR(enabled_state)) {
+               ret = PTR_ERR(enabled_state);
+               goto err_valid_state_put;
+       }
+       if (enabled_bit >= 32) {                /* BITS_PER_U32 */
+               ret = -EINVAL;
+               goto err_enabled_state_put;
+       }
 
        smp2p = kzalloc_obj(*smp2p);
-       if (!smp2p)
-               return -ENOMEM;
+       if (!smp2p) {
+               ret = -ENOMEM;
+               goto err_enabled_state_put;
+       }
 
        smp2p->ipa = ipa;
 
@@ -289,6 +297,10 @@ err_null_smp2p:
        ipa->smp2p = NULL;
        mutex_destroy(&smp2p->mutex);
        kfree(smp2p);
+err_enabled_state_put:
+       qcom_smem_state_put(enabled_state);
+err_valid_state_put:
+       qcom_smem_state_put(valid_state);
 
        return ret;
 }
@@ -305,6 +317,8 @@ void ipa_smp2p_exit(struct ipa *ipa)
        ipa_smp2p_power_release(ipa);
        ipa->smp2p = NULL;
        mutex_destroy(&smp2p->mutex);
+       qcom_smem_state_put(smp2p->enabled_state);
+       qcom_smem_state_put(smp2p->valid_state);
        kfree(smp2p);
 }