[PATCH] net: ipa: Fix valid_state leak in ipa_smp2p_init()

[Wentao Liang]

qcom_smem_state_get() takes a reference on the state, but
ipa_smp2p_init() returns without releasing the "ipa-clock-enabled-valid"
state when the bit number is out of range, when the "ipa-clock-enabled"
state cannot be acquired or its bit number is out of range, when the
smp2p structure cannot be allocated, and on the error paths that free
the structure. Release the reference on all of these paths.

Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/net/ipa/ipa_smp2p.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c
index 78f6df2cad76..f45225b16722 100644
--- a/drivers/net/ipa/ipa_smp2p.c
+++ b/drivers/net/ipa/ipa_smp2p.c
@@ -232,21 +232,27 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
 					  &valid_bit);
 	if (IS_ERR(valid_state))
 		return PTR_ERR(valid_state);
-	if (valid_bit >= 32)		/* BITS_PER_U32 */
+	if (valid_bit >= 32) {		/* BITS_PER_U32 */
+		qcom_smem_state_put(valid_state);
 		return -EINVAL;
+	}
 
 	enabled_state = qcom_smem_state_get(dev, "ipa-clock-enabled",
 					    &enabled_bit);
-	if (IS_ERR(enabled_state))
+	if (IS_ERR(enabled_state)) {
+		qcom_smem_state_put(valid_state);
 		return PTR_ERR(enabled_state);
+	}
 	if (enabled_bit >= 32) {	/* BITS_PER_U32 */
 		qcom_smem_state_put(enabled_state);
+		qcom_smem_state_put(valid_state);
 		return -EINVAL;
 	}
 
 	smp2p = kzalloc_obj(*smp2p);
 	if (!smp2p) {
 		qcom_smem_state_put(enabled_state);
+		qcom_smem_state_put(valid_state);
 		return -ENOMEM;
 	}
 
@@ -293,6 +299,7 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
 	ipa->smp2p = NULL;
 	mutex_destroy(&smp2p->mutex);
 	qcom_smem_state_put(enabled_state);
+	qcom_smem_state_put(valid_state);
 	kfree(smp2p);
 
 	return ret;
-- 
2.34.1