Once kobject_init_and_add() has been called, the error path should call
kobject_put() to decrement the reference count for cleanup. Freeing the
object directly with kfree() bypasses the kobject cleanup path.

If sysfs_create_bin_file() fails, kobject_del() removes the kobject from
sysfs, but kobject_put() is still needed to drop the reference count and
release the object.

Fix this by replacing kfree() with kobject_put(). Then the object can be
freed by the release callback through kobject_cleanup().

This issue was found by a static analysis tool I am developing.

Fixes: 925a1da7477f ("firmware: Break out system_event_log in dmi-sysfs")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/firmware/dmi-sysfs.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c
index cda53d037715..adef7e379cbb 100644
--- a/drivers/firmware/dmi-sysfs.c
+++ b/drivers/firmware/dmi-sysfs.c
@@ -459,7 +459,7 @@ static int dmi_system_event_log(struct dmi_sysfs_entry *entry)
 				   &entry->kobj,
 				   "system_event_log");
 	if (ret)
-		goto out_free;
+		goto out_put;
 
 	ret = sysfs_create_bin_file(entry->child, &bin_attr_raw_event_log);
 	if (ret)
@@ -469,8 +469,8 @@ static int dmi_system_event_log(struct dmi_sysfs_entry *entry)
 
 out_del:
 	kobject_del(entry->child);
-out_free:
-	kfree(entry->child);
+out_put:
+	kobject_put(entry->child);
 	return ret;
 }
 
-- 
2.43.0