[PATCH] fsi: i2cr: fix memory leak on registration failure

[Guangshuo Li]

i2cr_probe() allocates i2cr with kzalloc_obj(), but returns directly
when fsi_master_register() fails, leaving the allocation unreleased.

fsi_master_register() can fail before or after device_register() has
initialized master.dev. If master index allocation fails, master.idx is
negative and the device has not entered the device model. In this case,
release the device tree node reference and device name, then free i2cr
directly.

If device_register() fails, master.dev has already been initialized and
holds its initial reference. Drop that reference with put_device() so
i2cr_release() runs and frees i2cr. This also releases the device tree
node reference through the existing release callback.

This issue was found by manual code inspection.

Fixes: 53e89e3e4490 ("fsi: Add IBM I2C Responder virtual FSI master")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 drivers/fsi/fsi-master-i2cr.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/fsi/fsi-master-i2cr.c b/drivers/fsi/fsi-master-i2cr.c
index f76af608c421..c5e504d67a46 100644
--- a/drivers/fsi/fsi-master-i2cr.c
+++ b/drivers/fsi/fsi-master-i2cr.c
@@ -279,9 +279,17 @@ static int i2cr_probe(struct i2c_client *client)
 	i2cr->client = client;
 
 	ret = fsi_master_register(&i2cr->master);
-	if (ret)
-		return ret;
+	if (ret) {
+		if (i2cr->master.idx < 0) {
+			of_node_put(i2cr->master.dev.of_node);
+			kfree_const(i2cr->master.dev.kobj.name);
+			kfree(i2cr);
+		} else {
+			put_device(&i2cr->master.dev);
+		}
 
+		return ret;
+	}
 	i2c_set_clientdata(client, i2cr);
 	return 0;
 }
-- 
2.43.0