[PATCH] net: ipa: Fix enabled_state leak in ipa_smp2p_init()
flat view
COLD26d
From: Wentao Liang <hidden>
Date: 2026-09-17 11:52:28
Also in:
lkml, stable
Subsystem:
networking drivers, qcom ipa driver, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Alex Elder, Linus Torvalds
qcom_smem_state_get() takes a reference on the state, but
ipa_smp2p_init() returns without releasing the "ipa-clock-enabled" state
when the bit number is out of range, when the smp2p structure cannot be
allocated, and on the error paths that free the structure. Release the
reference on all of these paths.
Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <redacted>
---
drivers/net/ipa/ipa_smp2p.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c
index 2f0ccdd937cc..78f6df2cad76 100644
--- a/drivers/net/ipa/ipa_smp2p.c
+++ b/drivers/net/ipa/ipa_smp2p.c@@ -239,12 +239,16 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init) &enabled_bit); if (IS_ERR(enabled_state)) return PTR_ERR(enabled_state); - if (enabled_bit >= 32) /* BITS_PER_U32 */ + if (enabled_bit >= 32) { /* BITS_PER_U32 */ + qcom_smem_state_put(enabled_state); return -EINVAL; + } smp2p = kzalloc_obj(*smp2p); - if (!smp2p) + if (!smp2p) { + qcom_smem_state_put(enabled_state); return -ENOMEM; + } smp2p->ipa = ipa;
@@ -288,6 +292,7 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init) err_null_smp2p: ipa->smp2p = NULL; mutex_destroy(&smp2p->mutex); + qcom_smem_state_put(enabled_state); kfree(smp2p); return ret;
--
2.34.1