[PATCH 7/9] coresight: Fix resource leaks on coresight_build_path() errors

[James Clark]

If allocating the path node fails in _coresight_build_path(), the
references taken by coresight_grab_device() just before are leaked.
Drop them before returning.

Also, when _coresight_build_path() fails, nodes for devices further
along the path may have already been added and grabbed, but
coresight_build_path() only frees the path itself. Use
coresight_release_path_locked() to drop and free any nodes too.

Fixes: b3e94405941e ("coresight: associating path with session rather than tracer")
Fixes: 32b0707a4182 ("coresight: Add try_get_module() in coresight_grab_device()")
Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
Closes: https://sashiko.dev/#/bug/linux-fe264804-52b6-4b0d-a43e-184e228df19b
Signed-off-by: James Clark <james.clark@xxxxxxxxxx>
---
 drivers/hwtracing/coresight/coresight-core.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c
index fe64c509bf67..1d9c7ced39d2 100644
--- a/drivers/hwtracing/coresight/coresight-core.c
+++ b/drivers/hwtracing/coresight/coresight-core.c
@@ -1103,8 +1103,10 @@ static int _coresight_build_path(struct coresight_device *csdev,
 		return ret;
 
 	node = kzalloc_obj(struct coresight_node);
-	if (!node)
+	if (!node) {
+		coresight_drop_device(csdev);
 		return -ENOMEM;
+	}
 
 	node->csdev = csdev;
 	list_add(&node->link, &path->path_list);
@@ -1131,7 +1133,7 @@ struct coresight_path *coresight_build_path(struct coresight_device *source,
 
 	rc = _coresight_build_path(source, source, sink, path);
 	if (rc) {
-		kfree(path);
+		coresight_release_path_locked(path);
 		return ERR_PTR(rc);
 	}
 

-- 
2.43.0