nv_tco_getdevice() leaves the reference taken by for_each_pci_dev()
stored in the global tco_pci, but nothing in the driver ever drops it:
the error paths of nv_tco_getdevice() (bad BAR, request_region()
failure, SMI/NO_REBOOT failures) return with the reference held, and
nv_tco_cleanup() never puts tco_pci either.  Every failed probe and
every module load/unload cycle therefore leaks one pci_dev reference.

Release the reference on the error paths of nv_tco_getdevice() and in
nv_tco_cleanup() after the last use of tco_pci.

Fixes: 456c730153fe ("watchdog: Add TCO support for nVidia chipsets")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/watchdog/nv_tco.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/watchdog/nv_tco.c b/drivers/watchdog/nv_tco.c
index f16cee5173d5..9ce8325b4d3f 100644
--- a/drivers/watchdog/nv_tco.c
+++ b/drivers/watchdog/nv_tco.c
@@ -324,14 +324,14 @@ static unsigned char nv_tco_getdevice(void)
 	if (val == 0x0001 || val == 0x0000) {
 		/* Something is wrong here, bar isn't setup */
 		pr_err("failed to get tcobase address\n");
-		return 0;
+		goto err;
 	}
 	val &= 0xff00;
 	tcobase = val + 0x40;
 
 	if (!request_region(tcobase, 0x10, "NV TCO")) {
 		pr_err("I/O address 0x%04x already in use\n", tcobase);
-		return 0;
+		goto err;
 	}
 
 	/* Set a reasonable heartbeat before we stop the timer */
@@ -373,6 +373,9 @@ static unsigned char nv_tco_getdevice(void)
 	return 1;
 out:
 	release_region(tcobase, 0x10);
+err:
+	pci_dev_put(tco_pci);
+	tco_pci = NULL;
 	return 0;
 }
 
@@ -443,6 +446,7 @@ static void nv_tco_cleanup(void)
 	/* Deregister */
 	misc_deregister(&nv_tco_miscdev);
 	release_region(tcobase, 0x10);
+	pci_dev_put(tco_pci);
 }
 
 static void nv_tco_remove(struct platform_device *dev)
-- 
2.34.1