[PATCH] media: mantis: fix memory leak in hopper_pci_probe()

[Dawei Feng]

In hopper_pci_probe(), two probe-error paths jump to the wrong cleanup
stage. If mantis_get_mac() fails after mantis_i2c_init() succeeds, the
function skips mantis_i2c_exit() and leaves the I2C adapter registered.
If mantis_stream_control() fails after mantis_pci_init() succeeds, the
function frees the mantis structure without undoing the PCI setup.

Route the affected error paths to the correct cleanup labels so that
hopper_pci_probe() releases resources in reverse order, matching the
cleanup flow already used by mantis_pci_probe().

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1-rc5.

An x86_64 allyesconfig build showed no new warnings. As we do
not have a Twinhan VP-3028 DVB-T board to test with, no runtime
testing was able to be performed.

Fixes: b3b961448f702 ("V4L/DVB (13795): [Mantis/Hopper] Code overhaul, add Hopper devices into the PCI ID list")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Zilin Guan <zilin@xxxxxxxxxx>
Signed-off-by: Dawei Feng <dawei.feng@xxxxxxxxxx>
---
 drivers/media/pci/mantis/hopper_cards.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/pci/mantis/hopper_cards.c b/drivers/media/pci/mantis/hopper_cards.c
index 050068308c10..b55543054727 100644
--- a/drivers/media/pci/mantis/hopper_cards.c
+++ b/drivers/media/pci/mantis/hopper_cards.c
@@ -175,7 +175,7 @@ static int hopper_pci_probe(struct pci_dev *pdev,
 	err = mantis_stream_control(mantis, STREAM_TO_HIF);
 	if (err < 0) {
 		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis stream control failed <%d>", err);
-		goto fail1;
+		goto fail2;
 	}
 
 	err = mantis_i2c_init(mantis);
@@ -187,7 +187,7 @@ static int hopper_pci_probe(struct pci_dev *pdev,
 	err = mantis_get_mac(mantis);
 	if (err < 0) {
 		dprintk(MANTIS_ERROR, 1, "ERROR: Mantis MAC address read failed <%d>", err);
-		goto fail2;
+		goto fail3;
 	}
 
 	err = mantis_dma_init(mantis);
-- 
2.34.1