[PATCH] staging: vme_user: fix flush_image leak in tsi148 bridge

[Cong Nguyen]

When error checking is enabled (err_chk=1), tsi148_probe() allocates an
extra master window resource, tsi148_device->flush_image, which is used
to flush posted writes by reading back over the VME bus. Unlike the
regular master windows, this resource is not linked into
tsi148_bridge->master_resources.

Because it is not on any resource list, it is freed neither by the probe
error path (which only walks the master_resources list) nor by
tsi148_remove(), so it is leaked whenever err_chk is set and either
probe fails after the allocation or the device is unbound / the module
is unloaded.

Free flush_image in both the probe error path and tsi148_remove(). This
is safe when err_chk is disabled: tsi148_device is allocated with
kzalloc() so flush_image is NULL and kfree(NULL) is a no-op.

Fixes: d22b8ed9a3b0 ("Staging: vme: add Tundra TSI148 VME-PCI Bridge driver")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Cong Nguyen <congnt264@xxxxxxxxx>
---
 drivers/staging/vme_user/vme_tsi148.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/vme_user/vme_tsi148.c b/drivers/staging/vme_user/vme_tsi148.c
index c695ad9b4ca2..8ee1e00cef4f 100644
--- a/drivers/staging/vme_user/vme_tsi148.c
+++ b/drivers/staging/vme_user/vme_tsi148.c
@@ -2513,6 +2513,7 @@ static int tsi148_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		list_del(pos);
 		kfree(master_image);
 	}
+	kfree(tsi148_device->flush_image);
 
 	tsi148_irq_exit(tsi148_bridge, pdev);
 err_irq:
@@ -2619,6 +2620,8 @@ static void tsi148_remove(struct pci_dev *pdev)
 		kfree(master_image);
 	}
 
+	kfree(bridge->flush_image);
+
 	iounmap(bridge->base);
 
 	pci_release_regions(pdev);
-- 
2.25.1