[PATCH] ASoC: img: Fix a reference count leak in img_i2s_in_set_fmt

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.

Signed-off-by: Qiushi Wu 
---
 sound/soc/img/img-i2s-in.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/soc/img/img-i2s-in.c b/sound/soc/img/img-i2s-in.c
index e30b66b94bf6..0843235d73c9 100644
--- a/sound/soc/img/img-i2s-in.c
+++ b/sound/soc/img/img-i2s-in.c
@@ -343,8 +343,10 @@ static int img_i2s_in_set_fmt(struct snd_soc_dai *dai, 
unsigned int fmt)
chan_control_mask = IMG_I2S_IN_CH_CTL_CLK_TRANS_MASK;
 
ret = pm_runtime_get_sync(i2s->dev);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_noidle(i2s->dev);
return ret;
+   }
 
for (i = 0; i < i2s->active_channels; i++)
img_i2s_in_ch_disable(i2s, i);
-- 
2.17.1

[PATCH] ASoC: img-parallel-out: Fix a reference count leak

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.

Signed-off-by: Qiushi Wu 
---
 sound/soc/img/img-parallel-out.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/soc/img/img-parallel-out.c b/sound/soc/img/img-parallel-out.c
index 5ddbe3a31c2e..4da49a42e854 100644
--- a/sound/soc/img/img-parallel-out.c
+++ b/sound/soc/img/img-parallel-out.c
@@ -163,8 +163,10 @@ static int img_prl_out_set_fmt(struct snd_soc_dai *dai, 
unsigned int fmt)
}
 
ret = pm_runtime_get_sync(prl->dev);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_noidle(prl->dev);
return ret;
+   }
 
reg = img_prl_out_readl(prl, IMG_PRL_OUT_CTL);
reg = (reg & ~IMG_PRL_OUT_CTL_EDGE_MASK) | control_set;
-- 
2.17.1

[PATCH] media: sti: Fix reference count leaks

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.

Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/sti/hva/hva-hw.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/sti/hva/hva-hw.c 
b/drivers/media/platform/sti/hva/hva-hw.c
index 401aaafa1710..bb13348be083 100644
--- a/drivers/media/platform/sti/hva/hva-hw.c
+++ b/drivers/media/platform/sti/hva/hva-hw.c
@@ -272,6 +272,7 @@ static unsigned long int hva_hw_get_ip_version(struct 
hva_dev *hva)
 
if (pm_runtime_get_sync(dev) < 0) {
dev_err(dev, "%s failed to get pm_runtime\n", HVA_PREFIX);
+   pm_runtime_put_noidle(dev);
mutex_unlock(>protect_mutex);
return -EFAULT;
}
@@ -553,6 +554,7 @@ void hva_hw_dump_regs(struct hva_dev *hva, struct seq_file 
*s)
 
if (pm_runtime_get_sync(dev) < 0) {
seq_puts(s, "Cannot wake up IP\n");
+   pm_runtime_put_noidle(dev);
mutex_unlock(>protect_mutex);
return;
}
-- 
2.17.1

[PATCH] media: exynos4-is: Fix several reference count leaks due to pm_runtime_get_sync

[wu000273]

From: Qiushi Wu 

On calling pm_runtime_get_sync() the reference count of the device
is incremented. In case of failure, decrement the
reference count before returning the error.

Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/exynos4-is/fimc-isp.c  | 4 +++-
 drivers/media/platform/exynos4-is/fimc-lite.c | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/exynos4-is/fimc-isp.c 
b/drivers/media/platform/exynos4-is/fimc-isp.c
index cde0d254ec1c..a77c49b18511 100644
--- a/drivers/media/platform/exynos4-is/fimc-isp.c
+++ b/drivers/media/platform/exynos4-is/fimc-isp.c
@@ -305,8 +305,10 @@ static int fimc_isp_subdev_s_power(struct v4l2_subdev *sd, 
int on)
 
if (on) {
ret = pm_runtime_get_sync(>pdev->dev);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put(>pdev->dev);
return ret;
+   }
set_bit(IS_ST_PWR_ON, >state);
 
ret = fimc_is_start_firmware(is);
diff --git a/drivers/media/platform/exynos4-is/fimc-lite.c 
b/drivers/media/platform/exynos4-is/fimc-lite.c
index 394e0818f2d5..92130d779137 100644
--- a/drivers/media/platform/exynos4-is/fimc-lite.c
+++ b/drivers/media/platform/exynos4-is/fimc-lite.c
@@ -470,7 +470,7 @@ static int fimc_lite_open(struct file *file)
set_bit(ST_FLITE_IN_USE, >state);
ret = pm_runtime_get_sync(>pdev->dev);
if (ret < 0)
-   goto unlock;
+   goto err_pm;
 
ret = v4l2_fh_open(file);
if (ret < 0)
-- 
2.17.1

[PATCH] media: exynos4-is: Fix a reference count leak due to pm_runtime_get_sync

[wu000273]

From: Qiushi Wu 

On calling pm_runtime_get_sync() the reference count of the device
is incremented. In case of failure, decrement the
reference count before returning the error.

Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/exynos4-is/media-dev.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/exynos4-is/media-dev.c 
b/drivers/media/platform/exynos4-is/media-dev.c
index 9aaf3b8060d5..cfb6891180b0 100644
--- a/drivers/media/platform/exynos4-is/media-dev.c
+++ b/drivers/media/platform/exynos4-is/media-dev.c
@@ -484,8 +484,10 @@ static int fimc_md_register_sensor_entities(struct fimc_md 
*fmd)
return -ENXIO;
 
ret = pm_runtime_get_sync(fmd->pmf);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put(fmd->pmf);
return ret;
+   }
 
fmd->num_sensors = 0;
 
-- 
2.17.1

[PATCH] media: exynos4-is: Fix a reference count leak

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.

Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/exynos4-is/mipi-csis.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c 
b/drivers/media/platform/exynos4-is/mipi-csis.c
index 540151bbf58f..1aac167abb17 100644
--- a/drivers/media/platform/exynos4-is/mipi-csis.c
+++ b/drivers/media/platform/exynos4-is/mipi-csis.c
@@ -510,8 +510,10 @@ static int s5pcsis_s_stream(struct v4l2_subdev *sd, int 
enable)
if (enable) {
s5pcsis_clear_counters(state);
ret = pm_runtime_get_sync(>pdev->dev);
-   if (ret && ret != 1)
+   if (ret && ret != 1) {
+   pm_runtime_put_noidle(>pdev->dev);
return ret;
+   }
}
 
mutex_lock(>lock);
-- 
2.17.1

[PATCH] media: ti-vpe: Fix a missing check and reference count leak

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
And also, when the call of function vpe_runtime_get() failed,
we won't call vpe_runtime_put().
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails
inside vpe_runtime_get().

Fixes: 4571912743ac ("[media] v4l: ti-vpe: Add VPE mem to mem driver")
Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/ti-vpe/vpe.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/ti-vpe/vpe.c 
b/drivers/media/platform/ti-vpe/vpe.c
index cff2fcd6d812..82d3ee45e2e9 100644
--- a/drivers/media/platform/ti-vpe/vpe.c
+++ b/drivers/media/platform/ti-vpe/vpe.c
@@ -2475,6 +2475,8 @@ static int vpe_runtime_get(struct platform_device *pdev)
 
r = pm_runtime_get_sync(>dev);
WARN_ON(r < 0);
+   if (r)
+   pm_runtime_put_noidle(>dev);
return r < 0 ? r : 0;
 }
 
-- 
2.17.1

[PATCH] media: stm32-dcmi: Fix a reference count leak

[wu000273]

From: Qiushi Wu 

Calling pm_runtime_get_sync increments the counter even in case of
failure, causing incorrect ref count if pm_runtime_put is not
called in error handling paths. Thus replace the jump target
"err_release_buffers" by "err_pm_putw".

Fixes: 152e0bf60219 ("media: stm32-dcmi: add power saving support")
Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/stm32/stm32-dcmi.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/media/platform/stm32/stm32-dcmi.c 
b/drivers/media/platform/stm32/stm32-dcmi.c
index b8931490b83b..fd1c41cba52f 100644
--- a/drivers/media/platform/stm32/stm32-dcmi.c
+++ b/drivers/media/platform/stm32/stm32-dcmi.c
@@ -733,7 +733,7 @@ static int dcmi_start_streaming(struct vb2_queue *vq, 
unsigned int count)
if (ret < 0) {
dev_err(dcmi->dev, "%s: Failed to start streaming, cannot get 
sync (%d)\n",
__func__, ret);
-   goto err_release_buffers;
+   goto err_pm_put;
}
 
ret = media_pipeline_start(>vdev->entity, >pipeline);
@@ -837,8 +837,6 @@ static int dcmi_start_streaming(struct vb2_queue *vq, 
unsigned int count)
 
 err_pm_put:
pm_runtime_put(dcmi->dev);
-
-err_release_buffers:
spin_lock_irq(>irqlock);
/*
 * Return all buffers to vb2 in QUEUED state.
-- 
2.17.1

[PATCH] media: s5p-mfc: Fix a reference count leak

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.

Fixes: c5086f130a77 ("[media] s5p-mfc: Use clock gating only on MFC v5 
hardware")
Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/s5p-mfc/s5p_mfc_pm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c 
b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
index 7d52431c2c83..62d2320a7218 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
@@ -79,8 +79,10 @@ int s5p_mfc_power_on(void)
int i, ret = 0;
 
ret = pm_runtime_get_sync(pm->device);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_noidle(pm->device);
return ret;
+   }
 
/* clock control */
for (i = 0; i < pm->num_clocks; i++) {
-- 
2.17.1

[PATCH] media: camss: Fix a reference count leak.

[wu000273]

From: Qiushi Wu 

Calling pm_runtime_get_sync increments the counter even in case of
failure, causing incorrect ref count if pm_runtime_put_sync is not
called in error handling paths. Thus replace the jump target
"error_pm_runtime_get" by "err_clocks".

Fixes: 02afa816dbbf ("media: camss: Add basic runtime PM support")
Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/qcom/camss/camss-vfe.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c 
b/drivers/media/platform/qcom/camss/camss-vfe.c
index a8c542fa647d..1e7f23538af6 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe.c
@@ -1261,7 +1261,7 @@ static int vfe_get(struct vfe_device *vfe)
 
ret = pm_runtime_get_sync(vfe->camss->dev);
if (ret < 0)
-   goto error_pm_runtime_get;
+   goto error_clocks;
 
ret = vfe_set_clock_rates(vfe);
if (ret < 0)
@@ -1295,8 +1295,6 @@ static int vfe_get(struct vfe_device *vfe)
 
 error_clocks:
pm_runtime_put_sync(vfe->camss->dev);
-
-error_pm_runtime_get:
camss_pm_domain_off(vfe->camss, vfe->id);
 
 error_pm_domain:
-- 
2.17.1

[PATCH] media: camss: Fix a reference count leak.

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
PM runtime put is not called in error handling paths.
Thus call pm_runtime_put_sync() if pm_runtime_get_sync() fails.

Fixes: 02afa816dbbf ("media: camss: Add basic runtime PM support")
Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/qcom/camss/camss-csiphy.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/qcom/camss/camss-csiphy.c 
b/drivers/media/platform/qcom/camss/camss-csiphy.c
index 008afb85023b..3c5b9082ad72 100644
--- a/drivers/media/platform/qcom/camss/camss-csiphy.c
+++ b/drivers/media/platform/qcom/camss/camss-csiphy.c
@@ -176,8 +176,10 @@ static int csiphy_set_power(struct v4l2_subdev *sd, int on)
int ret;
 
ret = pm_runtime_get_sync(dev);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_sync(dev);
return ret;
+   }
 
ret = csiphy_set_clock_rates(csiphy);
if (ret < 0) {
-- 
2.17.1

[PATCH] media: vsp1: Fix a reference count leak.

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.

Fixes: 1e6af546ee66 ("[media] v4l: vsp1: Implement runtime PM support")
Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/vsp1/vsp1_drv.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/vsp1/vsp1_drv.c 
b/drivers/media/platform/vsp1/vsp1_drv.c
index c650e45bb0ad..222c9e1261a0 100644
--- a/drivers/media/platform/vsp1/vsp1_drv.c
+++ b/drivers/media/platform/vsp1/vsp1_drv.c
@@ -846,8 +846,10 @@ static int vsp1_probe(struct platform_device *pdev)
pm_runtime_enable(>dev);
 
ret = pm_runtime_get_sync(>dev);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_noidle(>dev);
goto done;
+   }
 
vsp1->version = vsp1_read(vsp1, VI6_IP_VERSION);
pm_runtime_put_sync(>dev);
-- 
2.17.1

[PATCH] media: platform: fcp: Fix a reference count leak.

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.

Fixes: 6eaafbdb668b ("[media] v4l: rcar-fcp: Keep the coding style consistent")
Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/rcar-fcp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/rcar-fcp.c 
b/drivers/media/platform/rcar-fcp.c
index 5c6b00737fe7..05c712e00a2a 100644
--- a/drivers/media/platform/rcar-fcp.c
+++ b/drivers/media/platform/rcar-fcp.c
@@ -103,8 +103,10 @@ int rcar_fcp_enable(struct rcar_fcp_device *fcp)
return 0;
 
ret = pm_runtime_get_sync(fcp->dev);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_noidle(fcp->dev);
return ret;
+   }
 
return 0;
 }
-- 
2.17.1

[PATCH] media: rockchip/rga: Fix a reference count leak.

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code. Thus call pm_runtime_put_noidle()
if pm_runtime_get_sync() fails.

Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support")
Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/rockchip/rga/rga-buf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/platform/rockchip/rga/rga-buf.c 
b/drivers/media/platform/rockchip/rga/rga-buf.c
index 36b821ccc1db..bf9a75b75083 100644
--- a/drivers/media/platform/rockchip/rga/rga-buf.c
+++ b/drivers/media/platform/rockchip/rga/rga-buf.c
@@ -81,6 +81,7 @@ static int rga_buf_start_streaming(struct vb2_queue *q, 
unsigned int count)
 
ret = pm_runtime_get_sync(rga->dev);
if (ret < 0) {
+   pm_runtime_put_noidle(rga->dev);
rga_buf_return_buffers(q, VB2_BUF_STATE_QUEUED);
return ret;
}
-- 
2.17.1

[PATCH] media: mtk-jpeg: Fix a reference count leak.

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code. Thus call pm_runtime_put_noidle()
if pm_runtime_get_sync() fails.

Fixes: b2f0d2724ba4 ("[media] vcodec: mediatek: Add Mediatek JPEG Decoder 
Driver")
Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c 
b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
index f82a81a3bdee..097f0b050f67 100644
--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
@@ -710,8 +710,10 @@ static int mtk_jpeg_start_streaming(struct vb2_queue *q, 
unsigned int count)
int ret = 0;
 
ret = pm_runtime_get_sync(ctx->jpeg->dev);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_noidle(ctx->jpeg->dev);
goto err;
+   }
 
return 0;
 err:
-- 
2.17.1

[PATCH] media: rcar-vin: Fix a reference count leak.

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code. Thus call pm_runtime_put_noidle()
if pm_runtime_get_sync() fails.

Fixes: 2a18fbec1dab ("media: rcar-vin: Move pm_runtime_{get,put} out of 
helpers")
Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/rcar-vin/rcar-v4l2.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/rcar-vin/rcar-v4l2.c 
b/drivers/media/platform/rcar-vin/rcar-v4l2.c
index f421e2584875..06808be35f98 100644
--- a/drivers/media/platform/rcar-vin/rcar-v4l2.c
+++ b/drivers/media/platform/rcar-vin/rcar-v4l2.c
@@ -835,8 +835,10 @@ static int rvin_open(struct file *file)
int ret;
 
ret = pm_runtime_get_sync(vin->dev);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_noidle(vin->dev);
return ret;
+   }
 
ret = mutex_lock_interruptible(>lock);
if (ret)
-- 
2.17.1

[PATCH] media: rcar-vin: Fix a reference count leak.

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code. Thus call pm_runtime_put_noidle()
if pm_runtime_get_sync() fails.

Fixes: 90dedce9bc54 ("media: rcar-vin: add function to manipulate Gen3 chsel 
value")
Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/rcar-vin/rcar-dma.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/rcar-vin/rcar-dma.c 
b/drivers/media/platform/rcar-vin/rcar-dma.c
index 1a30cd036371..95bc9e0e8792 100644
--- a/drivers/media/platform/rcar-vin/rcar-dma.c
+++ b/drivers/media/platform/rcar-vin/rcar-dma.c
@@ -1392,8 +1392,10 @@ int rvin_set_channel_routing(struct rvin_dev *vin, u8 
chsel)
int ret;
 
ret = pm_runtime_get_sync(vin->dev);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_noidle(vin->dev);
return ret;
+   }
 
/* Make register writes take effect immediately. */
vnmc = rvin_read(vin, VNMC_REG);
-- 
2.17.1

[PATCH] i2c: busses: Fix reference count leaks.

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code. Thus call pm_runtime_put_noidle()
if pm_runtime_get_sync() fails.

Signed-off-by: Qiushi Wu 
---
 drivers/i2c/busses/i2c-img-scb.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/i2c/busses/i2c-img-scb.c b/drivers/i2c/busses/i2c-img-scb.c
index 98a89301ed2a..e13ca862fa97 100644
--- a/drivers/i2c/busses/i2c-img-scb.c
+++ b/drivers/i2c/busses/i2c-img-scb.c
@@ -1058,8 +1058,10 @@ static int img_i2c_xfer(struct i2c_adapter *adap, struct 
i2c_msg *msgs,
}
 
ret = pm_runtime_get_sync(adap->dev.parent);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_noidle(adap->dev.parent);
return ret;
+   }
 
for (i = 0; i < num; i++) {
struct i2c_msg *msg = [i];
@@ -1159,8 +1161,10 @@ static int img_i2c_init(struct img_i2c *i2c)
int ret;
 
ret = pm_runtime_get_sync(i2c->adap.dev.parent);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_noidle(i2c->adap.dev.parent);
return ret;
+   }
 
rev = img_i2c_readl(i2c, SCB_CORE_REV_REG);
if ((rev & 0x00ff) < 0x00020200) {
-- 
2.17.1

[PATCH] i2c: busses: Fix a reference count leak.

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code. Thus call pm_runtime_put_noidle()
if pm_runtime_get_sync() fails.

Fixes: 13d6eb20fc79 ("i2c: imx-lpi2c: add runtime pm support")
Signed-off-by: Qiushi Wu 
---
 drivers/i2c/busses/i2c-imx-lpi2c.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-imx-lpi2c.c 
b/drivers/i2c/busses/i2c-imx-lpi2c.c
index 9db6ccded5e9..85b9c1fc7681 100644
--- a/drivers/i2c/busses/i2c-imx-lpi2c.c
+++ b/drivers/i2c/busses/i2c-imx-lpi2c.c
@@ -260,8 +260,10 @@ static int lpi2c_imx_master_enable(struct lpi2c_imx_struct 
*lpi2c_imx)
int ret;
 
ret = pm_runtime_get_sync(lpi2c_imx->adapter.dev.parent);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_noidle(lpi2c_imx->adapter.dev.parent);
return ret;
+   }
 
temp = MCR_RST;
writel(temp, lpi2c_imx->base + LPI2C_MCR);
-- 
2.17.1

[PATCH] i2c: xiic: Fix reference count leaks.

[wu000273]

From: Qiushi Wu 

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code. Thus call pm_runtime_put_noidle()
if pm_runtime_get_sync() fails.

Fixes: 36ecbcab84d0 ("i2c: xiic: Implement power management")
Signed-off-by: Qiushi Wu 
---
 drivers/i2c/busses/i2c-xiic.c | 8 ++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
index 90c1c362394d..ffec41e6be72 100644
--- a/drivers/i2c/busses/i2c-xiic.c
+++ b/drivers/i2c/busses/i2c-xiic.c
@@ -696,8 +696,10 @@ static int xiic_xfer(struct i2c_adapter *adap, struct 
i2c_msg *msgs, int num)
xiic_getreg8(i2c, XIIC_SR_REG_OFFSET));
 
err = pm_runtime_get_sync(i2c->dev);
-   if (err < 0)
+   if (err < 0) {
+   pm_runtime_put_noidle(i2c->dev);
return err;
+   }
 
err = xiic_busy(i2c);
if (err)
@@ -860,8 +862,10 @@ static int xiic_i2c_remove(struct platform_device *pdev)
i2c_del_adapter(>adap);
 
ret = pm_runtime_get_sync(i2c->dev);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put_noidle(i2c->dev);
return ret;
+   }
 
xiic_deinit(i2c);
pm_runtime_put_sync(i2c->dev);
-- 
2.17.1

[PATCH] char: hw_random: Fix a reference count leak.

[wu000273]

From: Qiushi Wu 

Calling pm_runtime_get_sync increments the counter even in case of
failure, causing incorrect ref count if pm_runtime_put_sync is not
called in error handling paths. Thus replace the jump target
"err_pm_get" by "err_clock".

Fixes: 6cd225cc5d8a ("hwrng: exynos - add Samsung Exynos True RNG driver")
Signed-off-by: Qiushi Wu 
---
 drivers/char/hw_random/exynos-trng.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/char/hw_random/exynos-trng.c 
b/drivers/char/hw_random/exynos-trng.c
index 8e1fe3f8dd2d..ffa7e0f061f0 100644
--- a/drivers/char/hw_random/exynos-trng.c
+++ b/drivers/char/hw_random/exynos-trng.c
@@ -135,7 +135,7 @@ static int exynos_trng_probe(struct platform_device *pdev)
ret = pm_runtime_get_sync(>dev);
if (ret < 0) {
dev_err(>dev, "Could not get runtime PM.\n");
-   goto err_pm_get;
+   goto err_clock;
}
 
trng->clk = devm_clk_get(>dev, "secss");
@@ -166,8 +166,6 @@ static int exynos_trng_probe(struct platform_device *pdev)
 
 err_clock:
pm_runtime_put_sync(>dev);
-
-err_pm_get:
pm_runtime_disable(>dev);
 
return ret;
-- 
2.17.1

[PATCH] ASoC: rockchip: Fix a reference count leak.

[wu000273]

From: Qiushi Wu 

Calling pm_runtime_get_sync increments the counter even in case of
failure, causing incorrect ref count if pm_runtime_put is not called in
error handling paths. Call pm_runtime_put if pm_runtime_get_sync fails.

Fixes: fc05a5b22253 ("ASoC: rockchip: add support for pdm controller")
Signed-off-by: Qiushi Wu 
---
 sound/soc/rockchip/rockchip_pdm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/soc/rockchip/rockchip_pdm.c 
b/sound/soc/rockchip/rockchip_pdm.c
index 7cd42fcfcf38..1707414cfa92 100644
--- a/sound/soc/rockchip/rockchip_pdm.c
+++ b/sound/soc/rockchip/rockchip_pdm.c
@@ -590,8 +590,10 @@ static int rockchip_pdm_resume(struct device *dev)
int ret;
 
ret = pm_runtime_get_sync(dev);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put(dev);
return ret;
+   }
 
ret = regcache_sync(pdm->regmap);
 
-- 
2.17.1

[PATCH] ASoC: tegra: Fix reference count leaks.

[wu000273]

From: Qiushi Wu 

Calling pm_runtime_get_sync increments the counter even in case of
failure, causing incorrect ref count if pm_runtime_put is not called in
error handling paths. Call pm_runtime_put if pm_runtime_get_sync fails.

Signed-off-by: Qiushi Wu 
---
 sound/soc/tegra/tegra30_ahub.c | 4 +++-
 sound/soc/tegra/tegra30_i2s.c  | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c
index 635eacbd28d4..156e3b9d613c 100644
--- a/sound/soc/tegra/tegra30_ahub.c
+++ b/sound/soc/tegra/tegra30_ahub.c
@@ -643,8 +643,10 @@ static int tegra30_ahub_resume(struct device *dev)
int ret;
 
ret = pm_runtime_get_sync(dev);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put(dev);
return ret;
+   }
ret = regcache_sync(ahub->regmap_ahub);
ret |= regcache_sync(ahub->regmap_apbif);
pm_runtime_put(dev);
diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c
index d59882ec48f1..db5a8587bfa4 100644
--- a/sound/soc/tegra/tegra30_i2s.c
+++ b/sound/soc/tegra/tegra30_i2s.c
@@ -567,8 +567,10 @@ static int tegra30_i2s_resume(struct device *dev)
int ret;
 
ret = pm_runtime_get_sync(dev);
-   if (ret < 0)
+   if (ret < 0) {
+   pm_runtime_put(dev);
return ret;
+   }
ret = regcache_sync(i2s->regmap);
pm_runtime_put(dev);
 
-- 
2.17.1

[PATCH] drm/amdkfd: Fix reference count leaks.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object.

Signed-off-by: Qiushi Wu 
---
 drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 20 +++-
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c 
b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index bb77f7af2b6d..dc3c4149f860 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -632,8 +632,10 @@ static int kfd_build_sysfs_node_entry(struct 
kfd_topology_device *dev,
 
ret = kobject_init_and_add(dev->kobj_node, _type,
sys_props.kobj_nodes, "%d", id);
-   if (ret < 0)
+   if (ret < 0) {
+   kobject_put(dev->kobj_node);
return ret;
+   }
 
dev->kobj_mem = kobject_create_and_add("mem_banks", dev->kobj_node);
if (!dev->kobj_mem)
@@ -680,8 +682,10 @@ static int kfd_build_sysfs_node_entry(struct 
kfd_topology_device *dev,
return -ENOMEM;
ret = kobject_init_and_add(mem->kobj, _type,
dev->kobj_mem, "%d", i);
-   if (ret < 0)
+   if (ret < 0) {
+   kobject_put(mem->kobj);
return ret;
+   }
 
mem->attr.name = "properties";
mem->attr.mode = KFD_SYSFS_FILE_MODE;
@@ -699,8 +703,10 @@ static int kfd_build_sysfs_node_entry(struct 
kfd_topology_device *dev,
return -ENOMEM;
ret = kobject_init_and_add(cache->kobj, _type,
dev->kobj_cache, "%d", i);
-   if (ret < 0)
+   if (ret < 0) {
+   kobject_put(cache->kobj);
return ret;
+   }
 
cache->attr.name = "properties";
cache->attr.mode = KFD_SYSFS_FILE_MODE;
@@ -718,8 +724,10 @@ static int kfd_build_sysfs_node_entry(struct 
kfd_topology_device *dev,
return -ENOMEM;
ret = kobject_init_and_add(iolink->kobj, _type,
dev->kobj_iolink, "%d", i);
-   if (ret < 0)
+   if (ret < 0) {
+   kobject_put(iolink->kobj);
return ret;
+   }
 
iolink->attr.name = "properties";
iolink->attr.mode = KFD_SYSFS_FILE_MODE;
@@ -798,8 +806,10 @@ static int kfd_topology_update_sysfs(void)
ret = kobject_init_and_add(sys_props.kobj_topology,
_type,  _device->kobj,
"topology");
-   if (ret < 0)
+   if (ret < 0) {
+   kobject_put(sys_props.kobj_topology);
return ret;
+   }
 
sys_props.kobj_nodes = kobject_create_and_add("nodes",
sys_props.kobj_topology);
-- 
2.17.1

[PATCH] firmware: dmi: Fix reference count leaks.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object.
Callback function dmi_sysfs_entry_release() in kobject_put()
can handle the pointer "entry" properly.

Signed-off-by: Qiushi Wu 
---
 drivers/firmware/dmi-sysfs.c | 9 +
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c
index b6180023eba7..9889e5ed2064 100644
--- a/drivers/firmware/dmi-sysfs.c
+++ b/drivers/firmware/dmi-sysfs.c
@@ -457,8 +457,10 @@ static int dmi_system_event_log(struct dmi_sysfs_entry 
*entry)
   _system_event_log_ktype,
   >kobj,
   "system_event_log");
-   if (ret)
-   goto out_free;
+   if (ret) {
+   kobject_put(entry->child);
+   return ret;
+   }
 
ret = sysfs_create_bin_file(entry->child, _sel_raw_attr);
if (ret)
@@ -468,7 +470,6 @@ static int dmi_system_event_log(struct dmi_sysfs_entry 
*entry)
 
 out_del:
kobject_del(entry->child);
-out_free:
kfree(entry->child);
return ret;
 }
@@ -603,7 +604,7 @@ static void __init dmi_sysfs_register_handle(const struct 
dmi_header *dh,
"%d-%d", dh->type, entry->instance);
 
if (*ret) {
-   kfree(entry);
+   kobject_put(>kobj);
return;
}
 
-- 
2.17.1

[PATCH] edd: Fix a reference count leak.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object.

Fixes: dd002e807486 ("Kobject: change drivers/firmware/edd.c to use 
kobject_init_and_add")
Signed-off-by: Qiushi Wu 
---
 drivers/firmware/edd.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/firmware/edd.c b/drivers/firmware/edd.c
index 14d0970a7198..c8bb58824a76 100644
--- a/drivers/firmware/edd.c
+++ b/drivers/firmware/edd.c
@@ -718,6 +718,8 @@ edd_device_register(struct edd_device *edev, int i)
if (!error) {
edd_populate_dir(edev);
kobject_uevent(>kobj, KOBJ_ADD);
+   } else {
+   kobject_put(>kobj);
}
return error;
 }
-- 
2.17.1

[PATCH] firmware: Fix a reference count leak.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object.
Callback function fw_cfg_sysfs_release_entry() in kobject_put()
can handle the pointer "entry" properly.

Signed-off-by: Qiushi Wu 
---
 drivers/firmware/qemu_fw_cfg.c | 7 ---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
index 039e0f91dba8..6945c3c96637 100644
--- a/drivers/firmware/qemu_fw_cfg.c
+++ b/drivers/firmware/qemu_fw_cfg.c
@@ -605,8 +605,10 @@ static int fw_cfg_register_file(const struct fw_cfg_file 
*f)
/* register entry under "/sys/firmware/qemu_fw_cfg/by_key/" */
err = kobject_init_and_add(>kobj, _cfg_sysfs_entry_ktype,
   fw_cfg_sel_ko, "%d", entry->select);
-   if (err)
-   goto err_register;
+   if (err) {
+   kobject_put(>kobj);
+   return err;
+   }
 
/* add raw binary content access */
err = sysfs_create_bin_file(>kobj, _cfg_sysfs_attr_raw);
@@ -622,7 +624,6 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f)
 
 err_add_raw:
kobject_del(>kobj);
-err_register:
kfree(entry);
return err;
 }
-- 
2.17.1

[PATCH] ipmi: code cleanup and prevent potential issue.

[wu000273]

From: Qiushi Wu 

All the previous get/put operations against intf->refcount are
inside the mutex. Thus, put the last kref_put() also inside mutex
to make sure get/put functions execute in order and prevent the
potential race condition.

Signed-off-by: Qiushi Wu 
---
 drivers/char/ipmi/ipmi_msghandler.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/char/ipmi/ipmi_msghandler.c 
b/drivers/char/ipmi/ipmi_msghandler.c
index e1b22fe0916c..d34343e34272 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -2583,10 +2583,11 @@ static int __bmc_get_device_id(struct ipmi_smi *intf, 
struct bmc_device *bmc,
*guid =  bmc->guid;
}
 
+   kref_put(>refcount, intf_free);
+
mutex_unlock(>dyn_mutex);
mutex_unlock(>bmc_reg_mutex);
 
-   kref_put(>refcount, intf_free);
return rv;
 }
 
-- 
2.17.1

[PATCH] edac: Fix reference count leak in edac_device_register_sysfs_main_kobj.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() should be handled when it return an error,
because kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object. Previous
commit "b8eb718348b8" fixed a similar problem.

Fixes: b2ed215a3338 ("Kobject: change drivers/edac to use kobject_init_and_add")
Signed-off-by: Qiushi Wu 
---
 drivers/edac/edac_device_sysfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c
index 0e7ea3591b78..5e7593753799 100644
--- a/drivers/edac/edac_device_sysfs.c
+++ b/drivers/edac/edac_device_sysfs.c
@@ -275,6 +275,7 @@ int edac_device_register_sysfs_main_kobj(struct 
edac_device_ctl_info *edac_dev)
 
/* Error exit stack */
 err_kobj_reg:
+   kobject_put(_dev->kobj);
module_put(edac_dev->owner);
 
 err_out:
-- 
2.17.1

[PATCH] edac: Fix reference count leak in edac_pci_main_kobj_setup.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() should be handled when it return an error,
because kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object. Previous
commit "b8eb718348b8" fixed a similar problem. Thus replace calling
kfree() by calling kobject_put().

Fixes: b2ed215a3338 ("Kobject: change drivers/edac to use kobject_init_and_add")
Signed-off-by: Qiushi Wu 
---
 drivers/edac/edac_pci_sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
index 72c9eb9fdffb..53042af7262e 100644
--- a/drivers/edac/edac_pci_sysfs.c
+++ b/drivers/edac/edac_pci_sysfs.c
@@ -386,7 +386,7 @@ static int edac_pci_main_kobj_setup(void)
 
/* Error unwind statck */
 kobject_init_and_add_fail:
-   kfree(edac_pci_top_main_kobj);
+   kobject_put(edac_pci_top_main_kobj);
 
 kzalloc_fail:
module_put(THIS_MODULE);
-- 
2.17.1

[PATCH] scsi: Fix reference count leak in iscsi_boot_create_kobj.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() should be handled when it return an error,
because kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object. Previous
commit "b8eb718348b8" fixed a similar problem. Thus replace calling
kfree() by calling kobject_put().

Signed-off-by: Qiushi Wu 
---
 drivers/scsi/iscsi_boot_sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/iscsi_boot_sysfs.c b/drivers/scsi/iscsi_boot_sysfs.c
index e4857b728033..a64abe38db2d 100644
--- a/drivers/scsi/iscsi_boot_sysfs.c
+++ b/drivers/scsi/iscsi_boot_sysfs.c
@@ -352,7 +352,7 @@ iscsi_boot_create_kobj(struct iscsi_boot_kset *boot_kset,
boot_kobj->kobj.kset = boot_kset->kset;
if (kobject_init_and_add(_kobj->kobj, _boot_ktype,
 NULL, name, index)) {
-   kfree(boot_kobj);
+   kobject_put(_kobj->kobj);
return NULL;
}
boot_kobj->data = data;
-- 
2.17.1

[PATCH] omapfb: Fix reference count leak in display_init_sysfs.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object.
Because function omap_dss_put_device() doesn't handle dssdev->kobj,
thus we need insert kobject_put() to clean up the kobject,
when kobject_init_and_add() fails.

Fixes: f76ee892a99e ("omapfb: copy omapdss & displays for omapfb")
Signed-off-by: Qiushi Wu 
---
 drivers/video/fbdev/omap2/omapfb/dss/display-sysfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/video/fbdev/omap2/omapfb/dss/display-sysfs.c 
b/drivers/video/fbdev/omap2/omapfb/dss/display-sysfs.c
index 6dbe265b312d..51322ac7df07 100644
--- a/drivers/video/fbdev/omap2/omapfb/dss/display-sysfs.c
+++ b/drivers/video/fbdev/omap2/omapfb/dss/display-sysfs.c
@@ -316,6 +316,7 @@ int display_init_sysfs(struct platform_device *pdev)
>dev.kobj, "%s", dssdev->alias);
if (r) {
DSSERR("failed to create sysfs files\n");
+   kobject_put(>kobj);
omap_dss_put_device(dssdev);
goto err;
}
-- 
2.17.1

[PATCH] efi: Fix reference count leak in efivar_create_sysfs_entry.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() should be handled when it return an error,
because kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object. Previous
commit "b8eb718348b8" fixed a similar problem.

Signed-off-by: Qiushi Wu 
---
 drivers/firmware/efi/efivars.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
index 78ad1ba8c987..26528a46d99e 100644
--- a/drivers/firmware/efi/efivars.c
+++ b/drivers/firmware/efi/efivars.c
@@ -522,8 +522,10 @@ efivar_create_sysfs_entry(struct efivar_entry *new_var)
ret = kobject_init_and_add(_var->kobj, _ktype,
   NULL, "%s", short_name);
kfree(short_name);
-   if (ret)
+   if (ret) {
+   kobject_put(_var->kobj);
return ret;
+   }
 
kobject_uevent(_var->kobj, KOBJ_ADD);
if (efivar_entry_add(new_var, _sysfs_list)) {
-- 
2.17.1

[PATCH] efi/esrt: Fix reference count leak in esre_create_sysfs_entry.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object. Previous
commit "b8eb718348b8" fixed a similar problem.

Fixes: 0bb549052d33 ("efi: Add esrt support")
Signed-off-by: Qiushi Wu 
---
 drivers/firmware/efi/esrt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c
index e3d692696583..d5915272141f 100644
--- a/drivers/firmware/efi/esrt.c
+++ b/drivers/firmware/efi/esrt.c
@@ -181,7 +181,7 @@ static int esre_create_sysfs_entry(void *esre, int 
entry_num)
rc = kobject_init_and_add(>kobj, _ktype, NULL,
  "entry%d", entry_num);
if (rc) {
-   kfree(entry);
+   kobject_put(>kobj);
return rc;
}
}
-- 
2.17.1

[PATCH] cpuidle: Fix several reference count leaks.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object. Previous
commit "b8eb718348b8" fixed a similar problem.

Signed-off-by: Qiushi Wu 
---
 drivers/cpuidle/sysfs.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
index cdeedbf02646..55107565b319 100644
--- a/drivers/cpuidle/sysfs.c
+++ b/drivers/cpuidle/sysfs.c
@@ -515,7 +515,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device 
*device)
ret = kobject_init_and_add(>kobj, _state_cpuidle,
   >kobj, "state%d", i);
if (ret) {
-   kfree(kobj);
+   kobject_put(>kobj);
goto error_state;
}
cpuidle_add_s2idle_attr_group(kobj);
@@ -646,7 +646,7 @@ static int cpuidle_add_driver_sysfs(struct cpuidle_device 
*dev)
ret = kobject_init_and_add(>kobj, _driver_cpuidle,
   >kobj, "driver");
if (ret) {
-   kfree(kdrv);
+   kobject_put(>kobj);
return ret;
}
 
@@ -740,7 +740,7 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev)
error = kobject_init_and_add(>kobj, _cpuidle, 
_dev->kobj,
   "cpuidle");
if (error) {
-   kfree(kdev);
+   kobject_put(>kobj);
return error;
}
 
-- 
2.17.1

[PATCH] bonding: Fix reference count leak in bond_sysfs_slave_add.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object. Previous
commit "b8eb718348b8" fixed a similar problem.

Fixes: 07699f9a7c8d ("bonding: add sysfs /slave dir for bond slave devices.")
Signed-off-by: Qiushi Wu 
---
 drivers/net/bonding/bond_sysfs_slave.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/bonding/bond_sysfs_slave.c 
b/drivers/net/bonding/bond_sysfs_slave.c
index 007481557191..9b8346638f69 100644
--- a/drivers/net/bonding/bond_sysfs_slave.c
+++ b/drivers/net/bonding/bond_sysfs_slave.c
@@ -149,8 +149,10 @@ int bond_sysfs_slave_add(struct slave *slave)
 
err = kobject_init_and_add(>kobj, _ktype,
   &(slave->dev->dev.kobj), "bonding_slave");
-   if (err)
+   if (err) {
+   kobject_put(>kobj);
return err;
+   }
 
for (a = slave_attrs; *a; ++a) {
err = sysfs_create_file(>kobj, &((*a)->attr));
-- 
2.17.1

[PATCH] RDMA/core: Fix several reference count leaks.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object. Previous
commit "b8eb718348b8" fixed a similar problem.

Signed-off-by: Qiushi Wu 
---
 drivers/infiniband/core/sysfs.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 087682e6969e..defe9cd4c5ee 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -1058,8 +1058,7 @@ static int add_port(struct ib_core_device *coredev, int 
port_num)
   coredev->ports_kobj,
   "%d", port_num);
if (ret) {
-   kfree(p);
-   return ret;
+   goto err_put;
}
 
p->gid_attr_group = kzalloc(sizeof(*p->gid_attr_group), GFP_KERNEL);
@@ -1072,8 +1071,7 @@ static int add_port(struct ib_core_device *coredev, int 
port_num)
ret = kobject_init_and_add(>gid_attr_group->kobj, _attr_type,
   >kobj, "gid_attrs");
if (ret) {
-   kfree(p->gid_attr_group);
-   goto err_put;
+   goto err_put_gid_attrs;
}
 
if (device->ops.process_mad && is_full_dev) {
@@ -1404,8 +1402,10 @@ int ib_port_register_module_stat(struct ib_device 
*device, u8 port_num,
 
ret = kobject_init_and_add(kobj, ktype, >kobj, "%s",
   name);
-   if (ret)
+   if (ret) {
+   kobject_put(kobj);
return ret;
+   }
}
 
return 0;
-- 
2.17.1

[PATCH] RDMA/qib: Fix several reference count leak qib_create_port_files

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object. To fix these
issues, we correct the jump targets when the calls of
kobject_init_and_add() fail, to make sure they can be handled by
kobject_put(). Previous commit "b8eb718348b8" fixed a similar problem.

Signed-off-by: Qiushi Wu 
---
 drivers/infiniband/hw/qib/qib_sysfs.c | 8 
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c 
b/drivers/infiniband/hw/qib/qib_sysfs.c
index 568b21eb6ea1..017ed82070f9 100644
--- a/drivers/infiniband/hw/qib/qib_sysfs.c
+++ b/drivers/infiniband/hw/qib/qib_sysfs.c
@@ -760,7 +760,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 
port_num,
qib_dev_err(dd,
"Skipping linkcontrol sysfs info, (err %d) port %u\n",
ret, port_num);
-   goto bail;
+   goto bail_link;
}
kobject_uevent(>pport_kobj, KOBJ_ADD);
 
@@ -770,7 +770,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 
port_num,
qib_dev_err(dd,
"Skipping sl2vl sysfs info, (err %d) port %u\n",
ret, port_num);
-   goto bail_link;
+   goto bail_sl;
}
kobject_uevent(>sl2vl_kobj, KOBJ_ADD);
 
@@ -780,7 +780,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 
port_num,
qib_dev_err(dd,
"Skipping diag_counters sysfs info, (err %d) port %u\n",
ret, port_num);
-   goto bail_sl;
+   goto bail_diagc;
}
kobject_uevent(>diagc_kobj, KOBJ_ADD);
 
@@ -793,7 +793,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 
port_num,
qib_dev_err(dd,
 "Skipping Congestion Control sysfs info, (err %d) port %u\n",
 ret, port_num);
-   goto bail_diagc;
+   goto bail_cc;
}
 
kobject_uevent(>pport_cc_kobj, KOBJ_ADD);
-- 
2.17.1

[PATCH] Fix reference count leak in pci_create_slot

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object. Thus,
when call of kobject_init_and_add() fail, we should call kobject_put()
instead of kfree(). Previous commit "b8eb718348b8" fixed a similar problem.

Fixes: 5fe6cc60680d ("PCI: prevent duplicate slot names")
Signed-off-by: Qiushi Wu 
---
 drivers/pci/slot.c | 6 --
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
index cc386ef2fa12..3861505741e6 100644
--- a/drivers/pci/slot.c
+++ b/drivers/pci/slot.c
@@ -268,13 +268,16 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, 
int slot_nr,
slot_name = make_slot_name(name);
if (!slot_name) {
err = -ENOMEM;
+   kfree(slot);
goto err;
}
 
err = kobject_init_and_add(>kobj, _slot_ktype, NULL,
   "%s", slot_name);
-   if (err)
+   if (err) {
+   kobject_put(>kobj);
goto err;
+   }
 
INIT_LIST_HEAD(>list);
list_add(>list, >slots);
@@ -293,7 +296,6 @@ struct pci_slot *pci_create_slot(struct pci_bus *parent, 
int slot_nr,
mutex_unlock(_slot_mutex);
return slot;
 err:
-   kfree(slot);
slot = ERR_PTR(err);
goto out;
 }
-- 
2.17.1

[PATCH] vfio/mdev: Fix reference count leak in add_mdev_supported_type.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object. Thus,
replace kfree() by kobject_put() to fix this issue. Previous
commit "b8eb718348b8" fixed a similar problem.

Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
Signed-off-by: Qiushi Wu 
---
 drivers/vfio/mdev/mdev_sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vfio/mdev/mdev_sysfs.c b/drivers/vfio/mdev/mdev_sysfs.c
index 8ad14e5c02bf..917fd84c1c6f 100644
--- a/drivers/vfio/mdev/mdev_sysfs.c
+++ b/drivers/vfio/mdev/mdev_sysfs.c
@@ -110,7 +110,7 @@ static struct mdev_type *add_mdev_supported_type(struct 
mdev_parent *parent,
   "%s-%s", dev_driver_string(parent->dev),
   group->name);
if (ret) {
-   kfree(type);
+   kobject_put(>kobj);
return ERR_PTR(ret);
}
 
-- 
2.17.1

[PATCH V2] nilfs2: Fix reference count leak in nilfs_sysfs_create_device_group

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
In nilfs_sysfs_create_device_group(), the memory allocated by
kobject_init_and_add() is not freed when kobject_init_and_add()
fails. Fix this issue by calling kobject_put() to clean up the
kobject.

Fixes: da7141fb78db ("nilfs2: add /sys/fs/nilfs2/ group")
Signed-off-by: Qiushi Wu 
---
 V2: using kobject_put() to handle kobject_init_and_add() instead of
 kobject_del().

 fs/nilfs2/sysfs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index e60be7bb55b0..8416f915d118 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -999,8 +999,10 @@ int nilfs_sysfs_create_device_group(struct super_block *sb)
init_completion(>ns_dev_kobj_unregister);
err = kobject_init_and_add(>ns_dev_kobj, _dev_ktype, NULL,
"%s", sb->s_id);
-   if (err)
+   if (err) {
+   kobject_put(>ns_dev_kobj);
goto free_dev_subgroups;
+   }
 
err = nilfs_sysfs_create_mounted_snapshots_group(nilfs);
if (err)
-- 
2.17.1

[PATCH] ACPI: CPPC: Fix reference count leak in acpi_cppc_processor_probe.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object. Previous
commit "b8eb718348b8" fixed a similar problem.

Fixes: 158c998ea44b ("ACPI / CPPC: add sysfs support to compute delivered 
performance")
Signed-off-by: Qiushi Wu 
---
 drivers/acpi/cppc_acpi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
index 8b2e89c20c11..067067bc03d4 100644
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -846,6 +846,7 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)
"acpi_cppc");
if (ret) {
per_cpu(cpc_desc_ptr, pr->id) = NULL;
+   kobject_put(_ptr->kobj);
goto out_free;
}
 
-- 
2.17.1

[PATCH] ACPI: sysfs: Fix reference count leak in acpi_sysfs_add_hotplug_profile.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
Thus, when kobject_init_and_add() returns an error,
kobject_put() must be called to properly clean up the kobject.

Fixes: 3f8055c35836 ("ACPI / hotplug: Introduce user space interface for 
hotplug profiles")
Signed-off-by: Qiushi Wu 
---
 drivers/acpi/sysfs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index c60d2c6d31d6..3a89909b50a6 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -993,8 +993,10 @@ void acpi_sysfs_add_hotplug_profile(struct 
acpi_hotplug_profile *hotplug,
 
error = kobject_init_and_add(>kobj,
_hotplug_profile_ktype, hotplug_kobj, "%s", name);
-   if (error)
+   if (error) {
+   kobject_put(>kobj);
goto err_out;
+   }
 
kobject_uevent(>kobj, KOBJ_ADD);
return;
-- 
2.17.1

[PATCH] lightnvm: pblk: Fix reference count leak in pblk_sysfs_init.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
Thus, when kobject_init_and_add() returns an error,
kobject_put() must be called to properly clean up the kobject.

Fixes: a4bd217b4326 ("lightnvm: physical block device (pblk) target")
Signed-off-by: Qiushi Wu 
---
 drivers/lightnvm/pblk-sysfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/lightnvm/pblk-sysfs.c b/drivers/lightnvm/pblk-sysfs.c
index 6387302b03f2..90f1433b19a2 100644
--- a/drivers/lightnvm/pblk-sysfs.c
+++ b/drivers/lightnvm/pblk-sysfs.c
@@ -711,6 +711,7 @@ int pblk_sysfs_init(struct gendisk *tdisk)
"%s", "pblk");
if (ret) {
pblk_err(pblk, "could not register\n");
+   kobject_put(>kobj);
return ret;
}
 
-- 
2.17.1

[PATCH] iommu: Fix reference count leak in iommu_group_alloc.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
Thus, when kobject_init_and_add() returns an error,
kobject_put() must be called to properly clean up the kobject.

Fixes: d72e31c93746 ("iommu: IOMMU Groups")
Signed-off-by: Qiushi Wu 
---
 drivers/iommu/iommu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 1faa08c8bbb4..03d6a26687bc 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -510,7 +510,7 @@ struct iommu_group *iommu_group_alloc(void)
   NULL, "%d", group->id);
if (ret) {
ida_simple_remove(_group_ida, group->id);
-   kfree(group);
+   kobject_put(>kobj);
return ERR_PTR(ret);
}
 
-- 
2.17.1

[PATCH] nilfs2: Fix reference count leak in nilfs_sysfs_create_device_group

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
In nilfs_sysfs_create_device_group(), the memory allocated by
kobject_init_and_add() is not freed when kobject_init_and_add()
fails. Thus replace the jump target "free_dev_subgroups" by
"cleanup_dev_kobject".

Fixes: da7141fb78db ("nilfs2: add /sys/fs/nilfs2/ group")
Signed-off-by: Qiushi Wu 
---
 fs/nilfs2/sysfs.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index e60be7bb55b0..4a74756d52fe 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -1000,7 +1000,7 @@ int nilfs_sysfs_create_device_group(struct super_block 
*sb)
err = kobject_init_and_add(>ns_dev_kobj, _dev_ktype, NULL,
"%s", sb->s_id);
if (err)
-   goto free_dev_subgroups;
+   goto cleanup_dev_kobject;
 
err = nilfs_sysfs_create_mounted_snapshots_group(nilfs);
if (err)
@@ -1038,8 +1038,6 @@ int nilfs_sysfs_create_device_group(struct super_block 
*sb)
 
 cleanup_dev_kobject:
kobject_del(>ns_dev_kobj);
-
-free_dev_subgroups:
kfree(nilfs->ns_dev_subgroups);
 
 failed_create_device_group:
-- 
2.17.1

[PATCH] nilfs2: Fix reference count leak in nilfs_sysfs_create_snapshot_group.

[wu000273]

From: Qiushi Wu 

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object. Previous
commit "b8eb718348b8" fixed a similar problem.

Fixes: a5a7332a291b ("nilfs2: add 
/sys/fs/nilfs2//mounted_snapshots/group")
Signed-off-by: Qiushi Wu 
---
 fs/nilfs2/sysfs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index e60be7bb55b0..b2517c5e773a 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -209,8 +209,10 @@ int nilfs_sysfs_create_snapshot_group(struct nilfs_root 
*root)
"%llu", root->cno);
}
 
-   if (err)
+   if (err) {
+   kobject_put(>snapshot_kobj);
return err;
+   }
 
return 0;
 }
-- 
2.17.1

[PATCH V2] PCI: qcom: Improve exception handling in qcom_pcie_probe().

[wu000273]

From: Qiushi Wu 

This function contained improvable implementation details according to
exception handling.
1. pm_runtime_put() should be called after pm_runtime_get_sync() failed,
because the reference count will be increased despite of the failure.
Thus add the missed function call.
2. pm_runtime_disable() are called twice, after the call of phy_init() and
dw_pcie_host_init() failed. Thus remove redundant function calls.


Fixes: 6e5da6f7d824 ("PCI: qcom: Fix error handling in runtime PM support")
Co-developed-by: Markus Elfring 
Signed-off-by: Markus Elfring 
Signed-off-by: Qiushi Wu 
---
 V2: words adjustments and fix some typos 
 drivers/pci/controller/dwc/pcie-qcom.c | 5 +
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/pci/controller/dwc/pcie-qcom.c 
b/drivers/pci/controller/dwc/pcie-qcom.c
index 138e1a2d21cc..10393ab607bf 100644
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -1340,8 +1340,7 @@ static int qcom_pcie_probe(struct platform_device *pdev)
pm_runtime_enable(dev);
ret = pm_runtime_get_sync(dev);
if (ret < 0) {
-   pm_runtime_disable(dev);
-   return ret;
+   goto err_pm_runtime_put;
}
 
pci->dev = dev;
@@ -1401,7 +1400,6 @@ static int qcom_pcie_probe(struct platform_device *pdev)
 
ret = phy_init(pcie->phy);
if (ret) {
-   pm_runtime_disable(>dev);
goto err_pm_runtime_put;
}
 
@@ -1410,7 +1408,6 @@ static int qcom_pcie_probe(struct platform_device *pdev)
ret = dw_pcie_host_init(pp);
if (ret) {
dev_err(dev, "cannot initialize host\n");
-   pm_runtime_disable(>dev);
goto err_pm_runtime_put;
}
 
-- 
2.17.1

[PATCH] PCI: qcom: fix several error-hanlding problem.

[wu000273]

From: Qiushi Wu 

In function qcom_pcie_probe(), there are several error-handling problem.
1. pm_runtime_put() should be called after pm_runtime_get_sync() failed,
because refcount will be increased even pm_runtime_get_sync() returns 
an error.
2. pm_runtime_disable() are called twice, after the call of phy_init() and
dw_pcie_host_init() failed.
Fix these problem by pm_runtime_put() after the call of call 
pm_runtime_get_sync() failed. Also removing the redundant 
pm_runtime_disable().

Fixes: 6e5da6f7d824 ("PCI: qcom: Fix error handling in runtime PM support")
Signed-off-by: Qiushi Wu 
---
 drivers/pci/controller/dwc/pcie-qcom.c | 5 +
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/pci/controller/dwc/pcie-qcom.c 
b/drivers/pci/controller/dwc/pcie-qcom.c
index 138e1a2d21cc..10393ab607bf 100644
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -1340,8 +1340,7 @@ static int qcom_pcie_probe(struct platform_device *pdev)
pm_runtime_enable(dev);
ret = pm_runtime_get_sync(dev);
if (ret < 0) {
-   pm_runtime_disable(dev);
-   return ret;
+   goto err_pm_runtime_put;
}
 
pci->dev = dev;
@@ -1401,7 +1400,6 @@ static int qcom_pcie_probe(struct platform_device *pdev)
 
ret = phy_init(pcie->phy);
if (ret) {
-   pm_runtime_disable(>dev);
goto err_pm_runtime_put;
}
 
@@ -1410,7 +1408,6 @@ static int qcom_pcie_probe(struct platform_device *pdev)
ret = dw_pcie_host_init(pp);
if (ret) {
dev_err(dev, "cannot initialize host\n");
-   pm_runtime_disable(>dev);
goto err_pm_runtime_put;
}
 
-- 
2.17.1

[PATCH] qlcnic: fix missing release in qlcnic_83xx_interrupt_test.

[wu000273]

From: Qiushi Wu 

In function qlcnic_83xx_interrupt_test(), function
qlcnic_83xx_diag_alloc_res() is not handled by function
qlcnic_83xx_diag_free_res() after a call of the function
qlcnic_alloc_mbx_args() failed. Fix this issue by adding
a jump target "fail_mbx_args", and jump to this new target
when qlcnic_alloc_mbx_args() failed.

Fixes: b6b4316c8b2f ("qlcnic: Handle qlcnic_alloc_mbx_args() failure")
Signed-off-by: Qiushi Wu 
---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c 
b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 2a533280b124..29b9c728a65e 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -3651,7 +3651,7 @@ int qlcnic_83xx_interrupt_test(struct net_device *netdev)
ahw->diag_cnt = 0;
ret = qlcnic_alloc_mbx_args(, adapter, QLCNIC_CMD_INTRPT_TEST);
if (ret)
-   goto fail_diag_irq;
+   goto fail_mbx_args;
 
if (adapter->flags & QLCNIC_MSIX_ENABLED)
intrpt_id = ahw->intr_tbl[0].id;
@@ -3681,6 +3681,8 @@ int qlcnic_83xx_interrupt_test(struct net_device *netdev)
 
 done:
qlcnic_free_mbx_args();
+
+fail_mbx_args:
qlcnic_83xx_diag_free_res(netdev, drv_sds_rings);
 
 fail_diag_irq:
-- 
2.17.1

[PATCH] RDMA/core: fix missing release in add_port.

[wu000273]

From: Qiushi Wu 

In function add_port(), pointer p is not released in error paths.
Fix this issue by adding a kfree(p) into the end of error path.

Signed-off-by: Qiushi Wu 
---
 drivers/infiniband/core/sysfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 087682e6969e..04a003378dfc 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -1202,6 +1202,7 @@ static int add_port(struct ib_core_device *coredev, int 
port_num)
 
 err_put:
kobject_put(>kobj);
+   kfree(p);
return ret;
 }
 
-- 
2.17.1

[PATCH] treewide: fix incomplete error-handling in img_i2s_in_probe.

[wu000273]

From: Qiushi Wu 

Function "pm_runtime_get_sync()" is not handled by "pm_runtime_put()"
if "PTR_ERR(rst) == -EPROBE_DEFER". Fix this issue by adding
"pm_runtime_put()" into this error path.

Fixes: f65bb92ca12e ("ASoC: img-i2s-in: Add runtime PM")
Signed-off-by: Qiushi Wu 
---
 sound/soc/img/img-i2s-in.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/img/img-i2s-in.c b/sound/soc/img/img-i2s-in.c
index a495d1050d49..e30b66b94bf6 100644
--- a/sound/soc/img/img-i2s-in.c
+++ b/sound/soc/img/img-i2s-in.c
@@ -482,6 +482,7 @@ static int img_i2s_in_probe(struct platform_device *pdev)
if (IS_ERR(rst)) {
if (PTR_ERR(rst) == -EPROBE_DEFER) {
ret = -EPROBE_DEFER;
+   pm_runtime_put(>dev);
goto err_suspend;
}
 
-- 
2.17.1

[PATCH V2] media: s3c-camif: fix missing disable in tegra_adma_probe().

[wu000273]

From: Qiushi Wu 

"pm_runtime_enable()" was not handled by "pm_runtime_disable()"
after a call of the function “pm_runtime_get_sync()” failed.
Thus move the jump target “err_pm” before calling function 
"calling pm_runtime_disable()".

Fixes: babde1c243b2 ("[media] V4L: Add driver for S3C24XX/S3C64XX SoC series 
camera interface")
Signed-off-by: Qiushi Wu 
---

V2: improving commit messages.

---
 drivers/media/platform/s3c-camif/camif-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/s3c-camif/camif-core.c 
b/drivers/media/platform/s3c-camif/camif-core.c
index c6fbcd7036d6..12ee49638f44 100644
--- a/drivers/media/platform/s3c-camif/camif-core.c
+++ b/drivers/media/platform/s3c-camif/camif-core.c
@@ -500,8 +500,8 @@ static int s3c_camif_probe(struct platform_device *pdev)
camif_unregister_media_entities(camif);
 err_alloc:
pm_runtime_put(dev);
-   pm_runtime_disable(dev);
 err_pm:
+   pm_runtime_disable(dev);
camif_clk_put(camif);
 err_clk:
s3c_camif_unregister_subdev(camif);
-- 
2.17.1

[PATCH 2/2] orangefs: fix double-unlock issue in service_operation().

[wu000273]

From: Qiushi Wu 

spin_unlock(>lock) is called before calling wake_up_interruptible().
But spin_unlock() was called again after a call of the function
"wait_for_matching_downcall" failed. Fix this issue by remove
the second spin_unlock().

Signed-off-by: Qiushi Wu 
---
 fs/orangefs/waitqueue.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fs/orangefs/waitqueue.c b/fs/orangefs/waitqueue.c
index beafc33d57be..3981507ad920 100644
--- a/fs/orangefs/waitqueue.c
+++ b/fs/orangefs/waitqueue.c
@@ -152,7 +152,6 @@ int service_operation(struct orangefs_kernel_op_s *op,
 
/* got matching downcall; make sure status is in errno format */
if (!ret) {
-   spin_unlock(>lock);
op->downcall.status =
orangefs_normalize_to_errno(op->downcall.status);
ret = op->downcall.status;
-- 
2.17.1

[PATCH] usb: gadget: fix potential double-free in m66592_probe.

[wu000273]

From: Qiushi Wu 

m66592_free_request() is called under label "err_add_udc"
and "clean_up", and m66592->ep0_req is not set to NULL after
first free, leading to a double-free. Fix this issue by
setting m66592->ep0_req to NULL after the first free.

Fixes: 0f91349b89f3 ("usb: gadget: convert all users to the new udc 
infrastructure")
Signed-off-by: Qiushi Wu 
---
 drivers/usb/gadget/udc/m66592-udc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/m66592-udc.c 
b/drivers/usb/gadget/udc/m66592-udc.c
index 75d16a8902e6..931e6362a13d 100644
--- a/drivers/usb/gadget/udc/m66592-udc.c
+++ b/drivers/usb/gadget/udc/m66592-udc.c
@@ -1667,7 +1667,7 @@ static int m66592_probe(struct platform_device *pdev)
 
 err_add_udc:
m66592_free_request(>ep[0].ep, m66592->ep0_req);
-
+   m66592->ep0_req = NULL;
 clean_up3:
if (m66592->pdata->on_chip) {
clk_disable(m66592->clk);
-- 
2.17.1

[PATCH] platform/chrome: fix a double-unlock issue

[wu000273]

From: Qiushi Wu 

In function cros_ec_ishtp_probe(), "up_write" is already called
before function "cros_ec_dev_init". But "up_write" will be called
again after the calling of the function "cros_ec_dev_init" failed.
Thus add a call of the function “down_write” in this if branch
for the completion of the exception handling.

Fixes: 26a14267aff2 ("platform/chrome: Add ChromeOS EC ISHTP driver")
Signed-off-by: Qiushi Wu 
---
 drivers/platform/chrome/cros_ec_ishtp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/chrome/cros_ec_ishtp.c 
b/drivers/platform/chrome/cros_ec_ishtp.c
index 93a71e93a2f1..41d60af618c9 100644
--- a/drivers/platform/chrome/cros_ec_ishtp.c
+++ b/drivers/platform/chrome/cros_ec_ishtp.c
@@ -660,8 +660,10 @@ static int cros_ec_ishtp_probe(struct ishtp_cl_device 
*cl_device)
 
/* Register croc_ec_dev mfd */
rv = cros_ec_dev_init(client_data);
-   if (rv)
+   if (rv) {
+   down_write(_lock);
goto end_cros_ec_dev_init_error;
+   }
 
return 0;
 
-- 
2.17.1

[PATCH] RDMA: fix missing pci disable in pvrdma_pci_probe()

[wu000273]

From: Qiushi Wu 

In function pvrdma_pci_probe(), pdev was not disabled in one error
path. Thus replace the jump target “err_free_device” by
"err_disable_pdev".

Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
Signed-off-by: Qiushi Wu 
---
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c 
b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
index e580ae9cc55a..780fd2dfc07e 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
@@ -829,7 +829,7 @@ static int pvrdma_pci_probe(struct pci_dev *pdev,
!(pci_resource_flags(pdev, 1) & IORESOURCE_MEM)) {
dev_err(>dev, "PCI BAR region not MMIO\n");
ret = -ENOMEM;
-   goto err_free_device;
+   goto err_disable_pdev;
}
 
ret = pci_request_regions(pdev, DRV_NAME);
-- 
2.17.1

[PATCH] media: s3c-camif: fix missing disable in tegra_adma_probe().

[wu000273]

From: Qiushi Wu 

"pm_runtime_enable()" was not handled by "pm_runtime_disable()"
after a call of the function “pm_runtime_get_sync” failed.
Thus move the jump target “err_pm” before calling pm_runtime_disable().

Fixes: babde1c243b2 ("[media] V4L: Add driver for S3C24XX/S3C64XX SoC series 
camera interface")
Signed-off-by: Qiushi Wu 
---
 drivers/media/platform/s3c-camif/camif-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/s3c-camif/camif-core.c 
b/drivers/media/platform/s3c-camif/camif-core.c
index c6fbcd7036d6..12ee49638f44 100644
--- a/drivers/media/platform/s3c-camif/camif-core.c
+++ b/drivers/media/platform/s3c-camif/camif-core.c
@@ -500,8 +500,8 @@ static int s3c_camif_probe(struct platform_device *pdev)
camif_unregister_media_entities(camif);
 err_alloc:
pm_runtime_put(dev);
-   pm_runtime_disable(dev);
 err_pm:
+   pm_runtime_disable(dev);
camif_clk_put(camif);
 err_clk:
s3c_camif_unregister_subdev(camif);
-- 
2.17.1

[PATCH] net: sun: fix missing release regions in cas_init_one().

[wu000273]

From: Qiushi Wu 

In cas_init_one(), "pdev" is requested by "pci_request_regions", but it
was not released after a call of the function “pci_write_config_byte” 
failed. Thus replace the jump target “err_write_cacheline” by 
"err_out_free_res".

Fixes: 1f26dac32057 ("[NET]: Add Sun Cassini driver.")
Signed-off-by: Qiushi Wu 
---
 drivers/net/ethernet/sun/cassini.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/sun/cassini.c 
b/drivers/net/ethernet/sun/cassini.c
index e6d1aa882fa5..f1c8615ab6f0 100644
--- a/drivers/net/ethernet/sun/cassini.c
+++ b/drivers/net/ethernet/sun/cassini.c
@@ -4963,7 +4963,7 @@ static int cas_init_one(struct pci_dev *pdev, const 
struct pci_device_id *ent)
  cas_cacheline_size)) {
dev_err(>dev, "Could not set PCI cache "
   "line size\n");
-   goto err_write_cacheline;
+   goto err_out_free_res;
}
}
 #endif
@@ -5136,7 +5136,6 @@ static int cas_init_one(struct pci_dev *pdev, const 
struct pci_device_id *ent)
 err_out_free_res:
pci_release_regions(pdev);
 
-err_write_cacheline:
/* Try to restore it in case the error occurred after we
 * set it.
 */
-- 
2.17.1

[PATCH v2] net/mlx4_core: fix a memory leak bug.

[wu000273]

From: Qiushi Wu 

In function mlx4_opreq_action(), pointer "mailbox" is not released,
when mlx4_cmd_box() return and error, causing a memory leak bug.
Fix this issue by going to "out" label, mlx4_free_cmd_mailbox() can
free this pointer.

Fixes: fe6f700d6cbb ("net/mlx4_core: Respond to operation request by firmware")
Signed-off-by: Qiushi Wu 
---
 drivers/net/ethernet/mellanox/mlx4/fw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c 
b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 6e501af0e532..f6ff9620a137 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -2734,7 +2734,7 @@ void mlx4_opreq_action(struct work_struct *work)
if (err) {
mlx4_err(dev, "Failed to retrieve required operation: 
%d\n",
 err);
-   return;
+   goto out;
}
MLX4_GET(modifier, outbox, GET_OP_REQ_MODIFIER_OFFSET);
MLX4_GET(token, outbox, GET_OP_REQ_TOKEN_OFFSET);
-- 
2.17.1

[PATCH v3] rxrpc: fix a memory leak in rxkad_verify_response().

[wu000273]

From: Qiushi Wu 

A ticket was not released after a call of the function
“rxkad_decrypt_ticket” failed. Thus replace the jump target
“temporary_error_free_resp” by “temporary_error_free_ticket”.

Fixes: 8c2f826dc3631 ("rxrpc: Don't put crypto buffers on the stack")
Signed-off-by: Qiushi Wu 
---
 net/rxrpc/rxkad.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index 098f1f9ec53b..52a24d4ef5d8 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -1148,7 +1148,7 @@ static int rxkad_verify_response(struct rxrpc_connection 
*conn,
ret = rxkad_decrypt_ticket(conn, skb, ticket, ticket_len, _key,
   , _abort_code);
if (ret < 0)
-   goto temporary_error_free_resp;
+   goto temporary_error_free_ticket;
 
/* use the session key from inside the ticket to decrypt the
 * response */
@@ -1230,7 +1230,6 @@ static int rxkad_verify_response(struct rxrpc_connection 
*conn,
 
 temporary_error_free_ticket:
kfree(ticket);
-temporary_error_free_resp:
kfree(response);
 temporary_error:
/* Ignore the response packet if we got a temporary error such as
-- 
2.17.1

[PATCH v2] rxrpc: fix a memory leak bug.

[wu000273]

From: Qiushi Wu 

A ticket was not released after a call of the function
“rxkad_decrypt_ticket” failed. Thus replace the jump target
“temporary_error_free_resp” by “temporary_error_free_ticket”.

Fixes: 8c2f826dc3631 ("rxrpc: Don't put crypto buffers on the stack")
Signed-off-by: Qiushi Wu 
---
 net/rxrpc/rxkad.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index 098f1f9ec53b..52a24d4ef5d8 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -1148,7 +1148,7 @@ static int rxkad_verify_response(struct rxrpc_connection 
*conn,
ret = rxkad_decrypt_ticket(conn, skb, ticket, ticket_len, _key,
   , _abort_code);
if (ret < 0)
-   goto temporary_error_free_resp;
+   goto temporary_error_free_ticket;
 
/* use the session key from inside the ticket to decrypt the
 * response */
@@ -1230,7 +1230,6 @@ static int rxkad_verify_response(struct rxrpc_connection 
*conn,
 
 temporary_error_free_ticket:
kfree(ticket);
-temporary_error_free_resp:
kfree(response);
 temporary_error:
/* Ignore the response packet if we got a temporary error such as
-- 
2.17.1

[PATCH] drm/i915: fix a memory leak bug.

[wu000273]

From: Qiushi Wu 

In intel_gtt_setup_scratch_page(), pointer "page" is not released if
pci_dma_mapping_error() return an error, leading to a memory leak bug.
Fix this issue by freeing "page" before return.

Fixes: 0e87d2b06cb46 ("intel-gtt: initialize our own scratch page")
Signed-off-by: Qiushi Wu 
---
 drivers/char/agp/intel-gtt.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index 66a62d17a3f5..a56a50f2740f 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -304,8 +304,10 @@ static int intel_gtt_setup_scratch_page(void)
if (intel_private.needs_dmar) {
dma_addr = pci_map_page(intel_private.pcidev, page, 0,
PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
-   if (pci_dma_mapping_error(intel_private.pcidev, dma_addr))
+   if (pci_dma_mapping_error(intel_private.pcidev, dma_addr)) {
+   __free_page(page);
return -EINVAL;
+   }
 
intel_private.scratch_page_dma = dma_addr;
} else
-- 
2.17.1

[PATCH] net/mlx4_core: fix a memory leak bug.

[wu000273]

From: Qiushi Wu 

In function mlx4_opreq_action(), pointer "mailbox" is not released,
when mlx4_cmd_box() return and error, causing a memory leak bug.
Fix this issue by going to "out" label, mlx4_free_cmd_mailbox() can
free this pointer.

Fixes: fe6f700d6cbb7 ("Respond to operation request by firmware")
Signed-off-by: Qiushi Wu 
---
 drivers/net/ethernet/mellanox/mlx4/fw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c 
b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 6e501af0e532..f6ff9620a137 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -2734,7 +2734,7 @@ void mlx4_opreq_action(struct work_struct *work)
if (err) {
mlx4_err(dev, "Failed to retrieve required operation: 
%d\n",
 err);
-   return;
+   goto out;
}
MLX4_GET(modifier, outbox, GET_OP_REQ_MODIFIER_OFFSET);
MLX4_GET(token, outbox, GET_OP_REQ_TOKEN_OFFSET);
-- 
2.17.1

[PATCH] rxrpc: fix a memory leak bug.

[wu000273]

From: Qiushi Wu 

In function rxkad_verify_response(), pointer "ticket" is not released,
when function rxkad_decrypt_ticket() returns an error, causing a
memory leak bug.

Fixes: 8c2f826dc3631 ("rxrpc: Don't put crypto buffers on the stack")
Signed-off-by: Qiushi Wu 
---
 net/rxrpc/rxkad.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index 098f1f9ec53b..52a24d4ef5d8 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -1148,7 +1148,7 @@ static int rxkad_verify_response(struct rxrpc_connection 
*conn,
ret = rxkad_decrypt_ticket(conn, skb, ticket, ticket_len, _key,
   , _abort_code);
if (ret < 0)
-   goto temporary_error_free_resp;
+   goto temporary_error_free_ticket;
 
/* use the session key from inside the ticket to decrypt the
 * response */
@@ -1230,7 +1230,6 @@ static int rxkad_verify_response(struct rxrpc_connection 
*conn,
 
 temporary_error_free_ticket:
kfree(ticket);
-temporary_error_free_resp:
kfree(response);
 temporary_error:
/* Ignore the response packet if we got a temporary error such as
-- 
2.17.1

[PATCH v3] nfp: abm: Fix incomplete release of system resources in nfp_abm_vnic_set_mac()

[wu000273]

From: Qiushi Wu 

In function nfp_abm_vnic_set_mac, pointer nsp is allocated by nfp_nsp_open.
But when nfp_nsp_has_hwinfo_lookup fail, the pointer is not released,
which can lead to a memory leak bug. Thus add a call of the function
“nfp_nsp_close” for the completion of the exception handling.

Fixes: f6e71efdf9fb1 ("nfp: abm: look up MAC addresses via management FW")
Signed-off-by: Qiushi Wu 
---
 drivers/net/ethernet/netronome/nfp/abm/main.c | 21 ++-
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/drivers/net/ethernet/netronome/nfp/abm/main.c 
b/drivers/net/ethernet/netronome/nfp/abm/main.c
index 9183b3e85d21..f196789f62fe 100644
--- a/drivers/net/ethernet/netronome/nfp/abm/main.c
+++ b/drivers/net/ethernet/netronome/nfp/abm/main.c
@@ -265,8 +265,7 @@ nfp_abm_vnic_set_mac(struct nfp_pf *pf, struct nfp_abm 
*abm, struct nfp_net *nn,
 
if (id > pf->eth_tbl->count) {
nfp_warn(pf->cpp, "No entry for persistent MAC address\n");
-   eth_hw_addr_random(nn->dp.netdev);
-   return;
+   goto generate_random_address;
}
 
snprintf(hwinfo, sizeof(hwinfo), "eth%u.mac.pf%u",
@@ -276,14 +275,13 @@ nfp_abm_vnic_set_mac(struct nfp_pf *pf, struct nfp_abm 
*abm, struct nfp_net *nn,
if (IS_ERR(nsp)) {
nfp_warn(pf->cpp, "Failed to access the NSP for persistent MAC 
address: %ld\n",
 PTR_ERR(nsp));
-   eth_hw_addr_random(nn->dp.netdev);
-   return;
+   goto generate_random_address;
}
 
if (!nfp_nsp_has_hwinfo_lookup(nsp)) {
nfp_warn(pf->cpp, "NSP doesn't support PF MAC generation\n");
-   eth_hw_addr_random(nn->dp.netdev);
-   return;
+   nfp_nsp_close(nsp);
+   goto generate_random_address;
}
 
err = nfp_nsp_hwinfo_lookup(nsp, hwinfo, sizeof(hwinfo));
@@ -291,8 +289,7 @@ nfp_abm_vnic_set_mac(struct nfp_pf *pf, struct nfp_abm 
*abm, struct nfp_net *nn,
if (err) {
nfp_warn(pf->cpp, "Reading persistent MAC address failed: %d\n",
 err);
-   eth_hw_addr_random(nn->dp.netdev);
-   return;
+   goto generate_random_address;
}
 
if (sscanf(hwinfo, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx",
@@ -300,12 +297,16 @@ nfp_abm_vnic_set_mac(struct nfp_pf *pf, struct nfp_abm 
*abm, struct nfp_net *nn,
   _addr[3], _addr[4], _addr[5]) != 6) {
nfp_warn(pf->cpp, "Can't parse persistent MAC address (%s)\n",
 hwinfo);
-   eth_hw_addr_random(nn->dp.netdev);
-   return;
+   goto generate_random_address;
}
 
ether_addr_copy(nn->dp.netdev->dev_addr, mac_addr);
ether_addr_copy(nn->dp.netdev->perm_addr, mac_addr);
+   return;
+
+generate_random_address:
+   eth_hw_addr_random(nn->dp.netdev);
+   return;
 }
 
 static int
-- 
2.17.1

[PATCH v2] nfp: abm: Fix incomplete release of system resources in nfp_abm_vnic_set_mac()

[wu000273]

From: Qiushi Wu 

In function nfp_abm_vnic_set_mac, pointer nsp is allocated by nfp_nsp_open.
But when nfp_nsp_has_hwinfo_lookup fail, the pointer is not released,
which can lead to a memory leak bug. Thus add a call of the function
“nfp_nsp_close” for the completion of the exception handling.

Fixes: f6e71efdf9fb1 ("nfp: abm: look up MAC addresses via management FW")
Signed-off-by: Qiushi Wu 
---
 drivers/net/ethernet/netronome/nfp/abm/main.c | 20 +--
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/drivers/net/ethernet/netronome/nfp/abm/main.c 
b/drivers/net/ethernet/netronome/nfp/abm/main.c
index 9183b3e85d21..a5152f11e2f5 100644
--- a/drivers/net/ethernet/netronome/nfp/abm/main.c
+++ b/drivers/net/ethernet/netronome/nfp/abm/main.c
@@ -265,8 +265,7 @@ nfp_abm_vnic_set_mac(struct nfp_pf *pf, struct nfp_abm 
*abm, struct nfp_net *nn,
 
if (id > pf->eth_tbl->count) {
nfp_warn(pf->cpp, "No entry for persistent MAC address\n");
-   eth_hw_addr_random(nn->dp.netdev);
-   return;
+   goto generate_random_address;
}
 
snprintf(hwinfo, sizeof(hwinfo), "eth%u.mac.pf%u",
@@ -276,14 +275,13 @@ nfp_abm_vnic_set_mac(struct nfp_pf *pf, struct nfp_abm 
*abm, struct nfp_net *nn,
if (IS_ERR(nsp)) {
nfp_warn(pf->cpp, "Failed to access the NSP for persistent MAC 
address: %ld\n",
 PTR_ERR(nsp));
-   eth_hw_addr_random(nn->dp.netdev);
-   return;
+   goto generate_random_address;
}
 
if (!nfp_nsp_has_hwinfo_lookup(nsp)) {
nfp_warn(pf->cpp, "NSP doesn't support PF MAC generation\n");
-   eth_hw_addr_random(nn->dp.netdev);
-   return;
+   nfp_nsp_close(nsp);
+   goto generate_random_address;
}
 
err = nfp_nsp_hwinfo_lookup(nsp, hwinfo, sizeof(hwinfo));
@@ -291,8 +289,7 @@ nfp_abm_vnic_set_mac(struct nfp_pf *pf, struct nfp_abm 
*abm, struct nfp_net *nn,
if (err) {
nfp_warn(pf->cpp, "Reading persistent MAC address failed: %d\n",
 err);
-   eth_hw_addr_random(nn->dp.netdev);
-   return;
+   goto generate_random_address;
}
 
if (sscanf(hwinfo, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx",
@@ -300,12 +297,15 @@ nfp_abm_vnic_set_mac(struct nfp_pf *pf, struct nfp_abm 
*abm, struct nfp_net *nn,
   _addr[3], _addr[4], _addr[5]) != 6) {
nfp_warn(pf->cpp, "Can't parse persistent MAC address (%s)\n",
 hwinfo);
-   eth_hw_addr_random(nn->dp.netdev);
-   return;
+   goto generate_random_address;
}
 
ether_addr_copy(nn->dp.netdev->dev_addr, mac_addr);
ether_addr_copy(nn->dp.netdev->perm_addr, mac_addr);
+
+generate_random_address:
+   eth_hw_addr_random(nn->dp.netdev);
+   return;
 }
 
 static int
-- 
2.17.1

[PATCH v2] rtc: mc13xxx: fix a double-unlock issue

[wu000273]

From: Qiushi Wu 

In function mc13xxx_rtc_probe, the mc13xxx_unlock() is called
before rtc_register_device(). But in the error path of
rtc_register_device(), the mc13xxx_unlock() is called again,
which causes a double-unlock problem. Thus add a call of the
function “mc13xxx_lock” in an if branch for the completion
of the exception handling.

Fixes: e4ae7023e182a ("rtc: mc13xxx: set range")
Signed-off-by: Qiushi Wu 
---
 drivers/rtc/rtc-mc13xxx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-mc13xxx.c b/drivers/rtc/rtc-mc13xxx.c
index afce2c0b4bd6..d6802e6191cb 100644
--- a/drivers/rtc/rtc-mc13xxx.c
+++ b/drivers/rtc/rtc-mc13xxx.c
@@ -308,8 +308,10 @@ static int __init mc13xxx_rtc_probe(struct platform_device 
*pdev)
mc13xxx_unlock(mc13xxx);
 
ret = rtc_register_device(priv->rtc);
-   if (ret)
+   if (ret) {
+   mc13xxx_lock(mc13xxx);
goto err_irq_request;
+   }
 
return 0;
 
-- 
2.17.1

[PATCH] power: supply: fix memory leaks (v2)

[wu000273]

From: Qiushi Wu 

In function power_supply_add_hwmon_sysfs(), psyhw->props is
allocated by bitmap_zalloc(). But this pointer is not deallocated
when devm_add_action fail,  which lead to a memory leak bug. To fix
this, we replace devm_add_action with devm_add_action_or_reset.

v2:
  - Prevent introducing double-free.
  - Added fixes tag

Fixes: e67d4dfc9ff19 ("power: supply: Add HWMON compatibility layer")
Signed-off-by: Qiushi Wu 
---
 drivers/power/supply/power_supply_hwmon.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/power/supply/power_supply_hwmon.c 
b/drivers/power/supply/power_supply_hwmon.c
index 75cf861ba492..7c8296ea0c34 100644
--- a/drivers/power/supply/power_supply_hwmon.c
+++ b/drivers/power/supply/power_supply_hwmon.c
@@ -304,7 +304,7 @@ int power_supply_add_hwmon_sysfs(struct power_supply *psy)
goto error;
}
 
-   ret = devm_add_action(dev, power_supply_hwmon_bitmap_free,
+   ret = devm_add_action_or_reset(dev, power_supply_hwmon_bitmap_free,
  psyhw->props);
if (ret)
goto error;
-- 
2.17.1

[PATCH] nfp: abm: fix a memory leak bug

[wu000273]

From: Qiushi Wu 

In function nfp_abm_vnic_set_mac, pointer nsp is allocated by nfp_nsp_open.
But when nfp_nsp_has_hwinfo_lookup fail, the pointer is not released,
which can lead to a memory leak bug. Fix this issue by adding
nfp_nsp_close(nsp) in the error path.

Signed-off-by: Qiushi Wu 
---
 drivers/net/ethernet/netronome/nfp/abm/main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/netronome/nfp/abm/main.c 
b/drivers/net/ethernet/netronome/nfp/abm/main.c
index 9183b3e85d21..354efffac0f9 100644
--- a/drivers/net/ethernet/netronome/nfp/abm/main.c
+++ b/drivers/net/ethernet/netronome/nfp/abm/main.c
@@ -283,6 +283,7 @@ nfp_abm_vnic_set_mac(struct nfp_pf *pf, struct nfp_abm 
*abm, struct nfp_net *nn,
if (!nfp_nsp_has_hwinfo_lookup(nsp)) {
nfp_warn(pf->cpp, "NSP doesn't support PF MAC generation\n");
eth_hw_addr_random(nn->dp.netdev);
+   nfp_nsp_close(nsp);
return;
}
 
-- 
2.17.1

[PATCH] power: supply: fix memory leaks

[wu000273]

From: Qiushi Wu 

In function power_supply_add_hwmon_sysfs(), psyhw->props is
allocated by bitmap_zalloc(). But this pointer is not deallocated
in several error paths, which lead to memory leak bugs. To fix
this, we can call bitmap_free() to free this pointer.

Signed-off-by: Qiushi Wu 
---
 drivers/power/supply/power_supply_hwmon.c | 8 +---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/power/supply/power_supply_hwmon.c 
b/drivers/power/supply/power_supply_hwmon.c
index 75cf861ba492..7453390ab7a4 100644
--- a/drivers/power/supply/power_supply_hwmon.c
+++ b/drivers/power/supply/power_supply_hwmon.c
@@ -307,7 +307,7 @@ int power_supply_add_hwmon_sysfs(struct power_supply *psy)
ret = devm_add_action(dev, power_supply_hwmon_bitmap_free,
  psyhw->props);
if (ret)
-   goto error;
+   goto out_free;
 
for (i = 0; i < desc->num_properties; i++) {
const enum power_supply_property prop = desc->properties[i];
@@ -342,7 +342,7 @@ int power_supply_add_hwmon_sysfs(struct power_supply *psy)
new_name = devm_kstrdup(dev, name, GFP_KERNEL);
if (!new_name) {
ret = -ENOMEM;
-   goto error;
+   goto out_free;
}
strreplace(new_name, '-', '_');
name = new_name;
@@ -353,10 +353,12 @@ int power_supply_add_hwmon_sysfs(struct power_supply *psy)
NULL);
ret = PTR_ERR_OR_ZERO(hwmon);
if (ret)
-   goto error;
+   goto out_free;
 
devres_close_group(dev, power_supply_add_hwmon_sysfs);
return 0;
+out_free:
+   bitmap_free(psyhw->props);
 error:
devres_release_group(dev, NULL);
return ret;
-- 
2.17.1

[PATCH] rtc: mc13xxx: fix a double-unlock issue

[wu000273]

From: Qiushi Wu 

In function mc13xxx_rtc_probe, the mc13xxx_unlock() is called
before rtc_register_device(). But in the error path of
rtc_register_device(), the mc13xxx_unlock() is called again,
which causes a double-unlock problem. To fix this problem, we
need to call mc13xxx_lock() again in this error path.

Signed-off-by: Qiushi Wu 
---
 drivers/rtc/rtc-mc13xxx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-mc13xxx.c b/drivers/rtc/rtc-mc13xxx.c
index afce2c0b4bd6..d6802e6191cb 100644
--- a/drivers/rtc/rtc-mc13xxx.c
+++ b/drivers/rtc/rtc-mc13xxx.c
@@ -308,8 +308,10 @@ static int __init mc13xxx_rtc_probe(struct platform_device 
*pdev)
mc13xxx_unlock(mc13xxx);
 
ret = rtc_register_device(priv->rtc);
-   if (ret)
+   if (ret) {
+   mc13xxx_lock(mc13xxx);
goto err_irq_request;
+   }
 
return 0;
 
-- 
2.17.1