[PATCH] fix: clocksource: timer-nxp-pit: pit_timer_init: cpuhp_setup_state failure leaks clockevent device

[WenTao Liang]

After pit_clockevent_per_cpu_init succeeds (registering a clockevent
  device and requesting an IRQ), if cpuhp_setup_state subsequently fails,
  the error path only unregisters the clocksource but not the clockevent
  device. This leaves the IRQ handler registered and per-CPU data uncleaned
  before kfree(pit), causing both a resource leak and potential
  use-after-free.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: bee33f22d7c3 ("clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
 drivers/clocksource/timer-nxp-pit.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/clocksource/timer-nxp-pit.c b/drivers/clocksource/timer-nxp-pit.c
index bc5157e2ba57..b77966faa112 100644
--- a/drivers/clocksource/timer-nxp-pit.c
+++ b/drivers/clocksource/timer-nxp-pit.c
@@ -329,11 +329,12 @@ static int pit_timer_init(struct device_node *np)
 		ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "PIT timer:starting",
 					pit_clockevent_starting_cpu, NULL);
 		if (ret < 0)
-			goto out_pit_clocksource_unregister;
+			goto out_pit_clockevent_unregister;
 	}
 
 	return 0;
-
+out_pit_clockevent_unregister:
+	pit_clockevent_per_cpu_exit(pit, pit_instances - 1);
 out_pit_clocksource_unregister:
 	clocksource_unregister(&pit->cs);
 out_pit_module_disable:
-- 
2.39.5 (Apple Git-154)