[PATCH] dca: fix provider device memory leak on domain allocation failure

[Guangshuo Li]

register_dca_provider() calls dca_sysfs_add_provider() before looking up
or allocating the DCA domain. A successful dca_sysfs_add_provider()
allocates an IDR entry and creates the dca%d class device.

If no domain exists and dca_allocate_domain() fails, the function
returns -ENODEV without calling dca_sysfs_remove_provider(). The class
device therefore remains registered and the IDR entry remains
allocated. The caller may subsequently free the dca_provider, leaving
the IDR entry pointing to freed memory.

Since the class device is never unregistered, its device reference is
not dropped and device_create_release() is never reached, leaking the
struct device allocation.

Call dca_sysfs_remove_provider() before returning when domain allocation
fails. This unregisters the class device and removes the corresponding
IDR entry.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: 1a5aeeecd550 ("dca: registering requesters in multiple dca domains")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 drivers/dca/dca-core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/dca/dca-core.c b/drivers/dca/dca-core.c
index 583510850fad..57e41fa87cca 100644
--- a/drivers/dca/dca-core.c
+++ b/drivers/dca/dca-core.c
@@ -368,8 +368,11 @@ int register_dca_provider(struct dca_provider *dca, struct device *dev)
 		raw_spin_unlock_irqrestore(&dca_lock, flags);
 		rc = dca_pci_rc_from_dev(dev);
 		newdomain = dca_allocate_domain(rc);
-		if (!newdomain)
+		if (!newdomain) {
+			dca_sysfs_remove_provider(dca);
 			return -ENODEV;
+		}
+
 		raw_spin_lock_irqsave(&dca_lock, flags);
 		/* Recheck, we might have raced after dropping the lock */
 		domain = dca_get_domain(dev);
-- 
2.43.0