[PATCH 4/6] dmaengine: idxd: Fix unwind bounds in device registration error paths

[Vinicius Costa Gomes]

When registering the per-idxd wq, engine, or group devices, a failure
partway through must roll back exactly the devices already added, i.e.
the range [0, i) when device_add() fails at index i.

idxd_register_{wq,engine,group}_devices() get this range wrong: each
seeds the "while (j--)" rollback loop with j = i - 1 instead of j = i.
This skips one device (leaking it), and when the very first device
fails (i == 0) the index underflows to -1 and the loop walks off the
front of the array.

Start the rollback at i.

Fixes: 7c5dd23e57c1 ("dmaengine: idxd: fix wq conf_dev 'struct device' lifetime")
Fixes: 75b911309060 ("dmaengine: idxd: fix engine conf_dev lifetime")
Fixes: defe49f96012 ("dmaengine: idxd: fix group conf_dev lifetime")
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@xxxxxxxxx>
---
 drivers/dma/idxd/sysfs.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c
index d5ffc641c856..e828292e5fb8 100644
--- a/drivers/dma/idxd/sysfs.c
+++ b/drivers/dma/idxd/sysfs.c
@@ -1876,7 +1876,7 @@ static int idxd_register_engine_devices(struct idxd_device *idxd)
 	return 0;
 
 cleanup:
-	j = i - 1;
+	j = i;
 	for (; i < idxd->max_engines; i++) {
 		engine = idxd->engines[i];
 		put_device(engine_confdev(engine));
@@ -1904,7 +1904,7 @@ static int idxd_register_group_devices(struct idxd_device *idxd)
 	return 0;
 
 cleanup:
-	j = i - 1;
+	j = i;
 	for (; i < idxd->max_groups; i++) {
 		group = idxd->groups[i];
 		put_device(group_confdev(group));
@@ -1932,7 +1932,7 @@ static int idxd_register_wq_devices(struct idxd_device *idxd)
 	return 0;
 
 cleanup:
-	j = i - 1;
+	j = i;
 	for (; i < idxd->max_wqs; i++) {
 		wq = idxd->wqs[i];
 		put_device(wq_confdev(wq));

-- 
2.56.0