i2cr_probe() allocates i2cr with kzalloc_obj(), but returns directly when fsi_master_register() fails, leaving the allocation unreleased. fsi_master_register() can fail before or after device_register() has initialized master.dev. If master index allocation fails, master.idx is negative and the device has not entered the device model. In this case, release the device tree node reference and device name, then free i2cr directly. If device_register() fails, master.dev has already been initialized and holds its initial reference. Drop that reference with put_device() so i2cr_release() runs and frees i2cr. This also releases the device tree node reference through the existing release callback. This issue was found by manual code inspection. Fixes: 53e89e3e4490 ("fsi: Add IBM I2C Responder virtual FSI master") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/fsi/fsi-master-i2cr.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/fsi/fsi-master-i2cr.c b/drivers/fsi/fsi-master-i2cr.c index f76af608c421..c5e504d67a46 100644 --- a/drivers/fsi/fsi-master-i2cr.c +++ b/drivers/fsi/fsi-master-i2cr.c @@ -279,9 +279,17 @@ static int i2cr_probe(struct i2c_client *client) i2cr->client = client; ret = fsi_master_register(&i2cr->master); - if (ret) - return ret; + if (ret) { + if (i2cr->master.idx < 0) { + of_node_put(i2cr->master.dev.of_node); + kfree_const(i2cr->master.dev.kobj.name); + kfree(i2cr); + } else { + put_device(&i2cr->master.dev); + } + return ret; + } i2c_set_clientdata(client, i2cr); return 0; } -- 2.43.0