[PATCH] net: ipa: Fix enabled_state leak in ipa_smp2p_init()

[Wentao Liang]

qcom_smem_state_get() takes a reference on the state, but
ipa_smp2p_init() returns without releasing the "ipa-clock-enabled" state
when the bit number is out of range, when the smp2p structure cannot be
allocated, and on the error paths that free the structure. Release the
reference on all of these paths.

Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/net/ipa/ipa_smp2p.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c
index 2f0ccdd937cc..78f6df2cad76 100644
--- a/drivers/net/ipa/ipa_smp2p.c
+++ b/drivers/net/ipa/ipa_smp2p.c
@@ -239,12 +239,16 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
 					    &enabled_bit);
 	if (IS_ERR(enabled_state))
 		return PTR_ERR(enabled_state);
-	if (enabled_bit >= 32)		/* BITS_PER_U32 */
+	if (enabled_bit >= 32) {	/* BITS_PER_U32 */
+		qcom_smem_state_put(enabled_state);
 		return -EINVAL;
+	}
 
 	smp2p = kzalloc_obj(*smp2p);
-	if (!smp2p)
+	if (!smp2p) {
+		qcom_smem_state_put(enabled_state);
 		return -ENOMEM;
+	}
 
 	smp2p->ipa = ipa;
 
@@ -288,6 +292,7 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
 err_null_smp2p:
 	ipa->smp2p = NULL;
 	mutex_destroy(&smp2p->mutex);
+	qcom_smem_state_put(enabled_state);
 	kfree(smp2p);
 
 	return ret;
-- 
2.34.1