qcom_smem_state_get() takes a reference on the state, but
ipa_smp2p_init() returns without releasing the "ipa-clock-enabled" state
when the bit number is out of range, when the smp2p structure cannot be
allocated, and on the error paths that free the structure. Release the
reference on all of these paths.

Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ipa/ipa_smp2p.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c
index 2f0ccdd937cc..78f6df2cad76 100644
--- a/drivers/net/ipa/ipa_smp2p.c
+++ b/drivers/net/ipa/ipa_smp2p.c
@@ -239,12 +239,16 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
 					    &enabled_bit);
 	if (IS_ERR(enabled_state))
 		return PTR_ERR(enabled_state);
-	if (enabled_bit >= 32)		/* BITS_PER_U32 */
+	if (enabled_bit >= 32) {	/* BITS_PER_U32 */
+		qcom_smem_state_put(enabled_state);
 		return -EINVAL;
+	}
 
 	smp2p = kzalloc_obj(*smp2p);
-	if (!smp2p)
+	if (!smp2p) {
+		qcom_smem_state_put(enabled_state);
 		return -ENOMEM;
+	}
 
 	smp2p->ipa = ipa;
 
@@ -288,6 +292,7 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
 err_null_smp2p:
 	ipa->smp2p = NULL;
 	mutex_destroy(&smp2p->mutex);
+	qcom_smem_state_put(enabled_state);
 	kfree(smp2p);
 
 	return ret;
-- 
2.34.1

On 9/17/26 6:52 AM, Wentao Liang wrote:
> qcom_smem_state_get() takes a reference on the state, but
> ipa_smp2p_init() returns without releasing the "ipa-clock-enabled" state
> when the bit number is out of range, when the smp2p structure cannot be
> allocated, and on the error paths that free the structure. Release the
> reference on all of these paths.

Where did you get the code used in this patch?  It doesn't
match what is currently present in Linux v7.2.

This issue was reported and already fixed:
   96ca1e658ae45 net: ipa: fix SMEM state handle leaks in SMP2P init

					-Alex

> Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>   drivers/net/ipa/ipa_smp2p.c | 9 +++++++--
>   1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c
> index 2f0ccdd937cc..78f6df2cad76 100644
> --- a/drivers/net/ipa/ipa_smp2p.c
> +++ b/drivers/net/ipa/ipa_smp2p.c
> @@ -239,12 +239,16 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
>   					    &enabled_bit);
>   	if (IS_ERR(enabled_state))
>   		return PTR_ERR(enabled_state);
> -	if (enabled_bit >= 32)		/* BITS_PER_U32 */
> +	if (enabled_bit >= 32) {	/* BITS_PER_U32 */
> +		qcom_smem_state_put(enabled_state);
>   		return -EINVAL;
> +	}
>   
>   	smp2p = kzalloc_obj(*smp2p);
> -	if (!smp2p)
> +	if (!smp2p) {
> +		qcom_smem_state_put(enabled_state);
>   		return -ENOMEM;
> +	}
>   
>   	smp2p->ipa = ipa;
>   
> @@ -288,6 +292,7 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
>   err_null_smp2p:
>   	ipa->smp2p = NULL;
>   	mutex_destroy(&smp2p->mutex);
> +	qcom_smem_state_put(enabled_state);
>   	kfree(smp2p);
>   
>   	return ret;