qcom_smem_state_get() takes a reference on the state, but ipa_smp2p_init() returns without releasing the "ipa-clock-enabled" state when the bit number is out of range, when the smp2p structure cannot be allocated, and on the error paths that free the structure. Release the reference on all of these paths. Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/net/ipa/ipa_smp2p.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c index 2f0ccdd937cc..78f6df2cad76 100644 --- a/drivers/net/ipa/ipa_smp2p.c +++ b/drivers/net/ipa/ipa_smp2p.c @@ -239,12 +239,16 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init) &enabled_bit); if (IS_ERR(enabled_state)) return PTR_ERR(enabled_state); - if (enabled_bit >= 32) /* BITS_PER_U32 */ + if (enabled_bit >= 32) { /* BITS_PER_U32 */ + qcom_smem_state_put(enabled_state); return -EINVAL; + } smp2p = kzalloc_obj(*smp2p); - if (!smp2p) + if (!smp2p) { + qcom_smem_state_put(enabled_state); return -ENOMEM; + } smp2p->ipa = ipa; @@ -288,6 +292,7 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init) err_null_smp2p: ipa->smp2p = NULL; mutex_destroy(&smp2p->mutex); + qcom_smem_state_put(enabled_state); kfree(smp2p); return ret; -- 2.34.1