qcom_smem_state_get() takes a reference on the state, but
ipa_smp2p_init() returns without releasing the "ipa-clock-enabled-valid"
state when the bit number is out of range, when the "ipa-clock-enabled"
state cannot be acquired or its bit number is out of range, when the
smp2p structure cannot be allocated, and on the error paths that free
the structure. Release the reference on all of these paths.

Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ipa/ipa_smp2p.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c
index 78f6df2cad76..f45225b16722 100644
--- a/drivers/net/ipa/ipa_smp2p.c
+++ b/drivers/net/ipa/ipa_smp2p.c
@@ -232,21 +232,27 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
 					  &valid_bit);
 	if (IS_ERR(valid_state))
 		return PTR_ERR(valid_state);
-	if (valid_bit >= 32)		/* BITS_PER_U32 */
+	if (valid_bit >= 32) {		/* BITS_PER_U32 */
+		qcom_smem_state_put(valid_state);
 		return -EINVAL;
+	}
 
 	enabled_state = qcom_smem_state_get(dev, "ipa-clock-enabled",
 					    &enabled_bit);
-	if (IS_ERR(enabled_state))
+	if (IS_ERR(enabled_state)) {
+		qcom_smem_state_put(valid_state);
 		return PTR_ERR(enabled_state);
+	}
 	if (enabled_bit >= 32) {	/* BITS_PER_U32 */
 		qcom_smem_state_put(enabled_state);
+		qcom_smem_state_put(valid_state);
 		return -EINVAL;
 	}
 
 	smp2p = kzalloc_obj(*smp2p);
 	if (!smp2p) {
 		qcom_smem_state_put(enabled_state);
+		qcom_smem_state_put(valid_state);
 		return -ENOMEM;
 	}
 
@@ -293,6 +299,7 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
 	ipa->smp2p = NULL;
 	mutex_destroy(&smp2p->mutex);
 	qcom_smem_state_put(enabled_state);
+	qcom_smem_state_put(valid_state);
 	kfree(smp2p);
 
 	return ret;
-- 
2.34.1

On Thu, Sep 17, 2026 at 11:54:24AM +0000, Wentao Liang wrote:
> qcom_smem_state_get() takes a reference on the state, but
> ipa_smp2p_init() returns without releasing the "ipa-clock-enabled-valid"
> state when the bit number is out of range, when the "ipa-clock-enabled"
> state cannot be acquired or its bit number is out of range, when the
> smp2p structure cannot be allocated, and on the error paths that free
> the structure. Release the reference on all of these paths.
> 
> Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/ipa/ipa_smp2p.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)

Did you forget the Assisted-by: tag?

Please reply to all of your sent patches and fix that up with new
versions.

thanks,

greg k-h

On 9/17/26 6:54 AM, Wentao Liang wrote:
> qcom_smem_state_get() takes a reference on the state, but
> ipa_smp2p_init() returns without releasing the "ipa-clock-enabled-valid"
> state when the bit number is out of range, when the "ipa-clock-enabled"
> state cannot be acquired or its bit number is out of range, when the
> smp2p structure cannot be allocated, and on the error paths that free
> the structure. Release the reference on all of these paths.

I haven't looked very closely at this one but it also seems
to have been fixed already.

   96ca1e658ae45 net: ipa: fix SMEM state handle leaks in SMP2P init

					-Alex

> 
> Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>   drivers/net/ipa/ipa_smp2p.c | 11 +++++++++--
>   1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c
> index 78f6df2cad76..f45225b16722 100644
> --- a/drivers/net/ipa/ipa_smp2p.c
> +++ b/drivers/net/ipa/ipa_smp2p.c
> @@ -232,21 +232,27 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
>   					  &valid_bit);
>   	if (IS_ERR(valid_state))
>   		return PTR_ERR(valid_state);
> -	if (valid_bit >= 32)		/* BITS_PER_U32 */
> +	if (valid_bit >= 32) {		/* BITS_PER_U32 */
> +		qcom_smem_state_put(valid_state);
>   		return -EINVAL;
> +	}
>   
>   	enabled_state = qcom_smem_state_get(dev, "ipa-clock-enabled",
>   					    &enabled_bit);
> -	if (IS_ERR(enabled_state))
> +	if (IS_ERR(enabled_state)) {
> +		qcom_smem_state_put(valid_state);
>   		return PTR_ERR(enabled_state);
> +	}
>   	if (enabled_bit >= 32) {	/* BITS_PER_U32 */
>   		qcom_smem_state_put(enabled_state);
> +		qcom_smem_state_put(valid_state);
>   		return -EINVAL;
>   	}
>   
>   	smp2p = kzalloc_obj(*smp2p);
>   	if (!smp2p) {
>   		qcom_smem_state_put(enabled_state);
> +		qcom_smem_state_put(valid_state);
>   		return -ENOMEM;
>   	}
>   
> @@ -293,6 +299,7 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
>   	ipa->smp2p = NULL;
>   	mutex_destroy(&smp2p->mutex);
>   	qcom_smem_state_put(enabled_state);
> +	qcom_smem_state_put(valid_state);
>   	kfree(smp2p);
>   
>   	return ret;