[PATCH] PNP: Detach device after resource transition failure

[Myeonghun Pak]

pnp_device_probe() attaches the PNP device before it activates or
disables its resources.  The attach changes the status from PNP_READY
to PNP_ATTACHED, but errors from either resource transition return
directly and leave that status behind.  A later bind or manual PNP
configuration attempt then sees a device that is still marked in use.

Route both errors through the existing failure path so it restores the
status to PNP_READY.  Do not disable the device or clean its resources:
pnp_activate_dev() only marks it active after a successful start, while
pnp_disable_dev() preserves the active state and resource table when
stopping fails.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>
---
 drivers/pnp/driver.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pnp/driver.c b/drivers/pnp/driver.c
index 6d58b1465081..80c2a0f15b80 100644
--- a/drivers/pnp/driver.c
+++ b/drivers/pnp/driver.c
@@ -96,13 +96,13 @@ static int pnp_device_probe(struct device *dev)
 		if (!(pnp_drv->flags & PNP_DRIVER_RES_DO_NOT_CHANGE)) {
 			error = pnp_activate_dev(pnp_dev);
 			if (error < 0)
-				return error;
+				goto fail;
 		}
 	} else if ((pnp_drv->flags & PNP_DRIVER_RES_DISABLE)
 		   == PNP_DRIVER_RES_DISABLE) {
 		error = pnp_disable_dev(pnp_dev);
 		if (error < 0)
-			return error;
+			goto fail;
 	}
 	error = 0;
 	if (pnp_drv->probe) {
-- 
2.50.1