After kref_init(), the device_get_match_data() failure path jumps to
out_free_channel. That path frees the mailbox channel and then falls
through to kfree(), bypassing mpfs_sys_controller_put() for the initial
reference.
Call mpfs_sys_controller_put() on that path and return immediately. The
existing kref release callback then performs the matching cleanup, and
the return prevents a second free through out_free. This is the minimal
change needed to keep the initialized lifetime balanced.
Fixes: 75ef23397558 ("soc: microchip: mpfs-sys-controller: fix resource leak on probe error")
---
drivers/soc/microchip/mpfs-sys-controller.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/soc/microchip/mpfs-sys-controller.c b/drivers/soc/microchip/mpfs-sys-controller.c
index 0400a01b2338..379e4f649faa 100644
--- a/drivers/soc/microchip/mpfs-sys-controller.c
+++ b/drivers/soc/microchip/mpfs-sys-controller.c
@@ -174,7 +174,8 @@ static int mpfs_sys_controller_probe(struct platform_device *pdev)
return 0;
out_free_channel:
- mbox_free_channel(sys_controller->chan);
+ mpfs_sys_controller_put(sys_controller);
+ return ret;
out_free:
kfree(sys_controller);
return ret;
base-commit: f03c39de3a1307371a4032757cd1732e91087c7d
--
2.43.0