If allocating the path node fails in _coresight_build_path(), the references taken by coresight_grab_device() just before are leaked. Drop them before returning.
Also, when _coresight_build_path() fails, nodes for devices further along the path may have already been added and grabbed, but coresight_build_path() only frees the path itself. Use coresight_release_path_locked() to drop and free any nodes too.
Fixes: b3e94405941e ("coresight: associating path with session rather than tracer") Fixes: 32b0707a4182 ("coresight: Add try_get_module() in coresight_grab_device()") Reported-by: Sashiko sashiko-bot@kernel.org Closes: https://sashiko.dev/#/bug/linux-fe264804-52b6-4b0d-a43e-184e228df19b Signed-off-by: James Clark james.clark@linaro.org --- drivers/hwtracing/coresight/coresight-core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c index c05d657cde73..bcfeb1c97127 100644 --- a/drivers/hwtracing/coresight/coresight-core.c +++ b/drivers/hwtracing/coresight/coresight-core.c @@ -1033,8 +1033,10 @@ static int _coresight_build_path(struct coresight_device *csdev, return ret;
node = kzalloc_obj(struct coresight_node); - if (!node) + if (!node) { + coresight_drop_device(csdev); return -ENOMEM; + }
node->csdev = csdev; list_add(&node->link, &path->path_list); @@ -1061,7 +1063,7 @@ struct coresight_path *coresight_build_path(struct coresight_device *source,
rc = _coresight_build_path(source, source, sink, path); if (rc) { - kfree(path); + coresight_release_path_locked(path); return ERR_PTR(rc); }