[PATCH] intel_th: Let release callback free subdevice resources

[Ruoyu Wang]

intel_th_subdevice_alloc() hands a fully initialized device to the
driver core with device_add(). If device_add() fails, the object must be
released with put_device(), which runs intel_th_device_release() and then
intel_th_device_free().

The failure path freed thdev->resource before calling put_device(), but
intel_th_device_free() frees the same pointer from the release callback.
Leave resource ownership with the device release path and jump directly
to put_device().

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: 512592779a337 ("intel_th: Fix a double put_device() in error path")
Signed-off-by: Ruoyu Wang <ruoyuw560@xxxxxxxxx>
---
 drivers/hwtracing/intel_th/core.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
index 3924e63e2eeeb..1d33c9e42c595 100644
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -683,7 +683,7 @@ intel_th_subdevice_alloc(struct intel_th *th,
 
 	err = device_add(&thdev->dev);
 	if (err)
-		goto fail_free_res;
+		goto fail_put_device;
 
 	/* need switch driver to be loaded to enumerate the rest */
 	if (subdev->type == INTEL_TH_SWITCH && !req) {
@@ -694,9 +694,6 @@ intel_th_subdevice_alloc(struct intel_th *th,
 
 	return thdev;
 
-fail_free_res:
-	kfree(thdev->resource);
-
 fail_put_device:
 	put_device(&thdev->dev);
 
-- 
2.51.0