bpf_token_create() allocates an inode before calling FD_PREPARE().
If descriptor allocation fails, alloc_file_pseudo() is never called.
If alloc_file_pseudo() fails, it leaves the inode reference with the
caller. Neither failure path releases the inode.
Call iput(inode) before returning the FD preparation error.

Fixes: 981bec8f698b ("bpf: convert bpf_token_create() to FD_PREPARE()")

Signed-off-by: Suchit Karunakaran <suchitkarunakaran@gmail.com>
---
 kernel/bpf/token.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/token.c b/kernel/bpf/token.c
index da915a4f972b..7375eaee6a23 100644
--- a/kernel/bpf/token.c
+++ b/kernel/bpf/token.c
@@ -169,8 +169,10 @@ int bpf_token_create(union bpf_attr *attr)
 	FD_PREPARE(fdf, O_CLOEXEC,
 		   alloc_file_pseudo(inode, path.mnt, BPF_TOKEN_INODE_NAME,
 				     O_RDWR, &bpf_token_fops));
-	if (fdf->fd < 0)
+	if (fdf->fd < 0) {
+		iput(inode);
 		return fdf->fd;
+	}
 
 	token = kzalloc_obj(*token, GFP_USER);
 	if (!token)
-- 
2.55.0