register_dca_provider() calls dca_sysfs_add_provider() before looking up
or allocating a DCA domain. If dca_allocate_domain() fails, it returns
-ENODEV without the matching dca_sysfs_remove_provider(), leaving the
dca%d class device registered and the corresponding IDR entry present.

Route the dca_allocate_domain() failure through a common
err_remove_provider path that calls dca_sysfs_remove_provider(), and
reuse it for the existing dca_providers_blocked cleanup.

The issue was identified by a static analysis tool and confirmed by
manual code inspection.

Fixes: 1a5aeeecd550 ("dca: registering requesters in multiple dca domains")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
v2:
  - Use a common error path for dca_sysfs_remove_provider() cleanup, as
    suggested by Markus Elfring.

 drivers/dca/dca-core.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/dca/dca-core.c b/drivers/dca/dca-core.c
index 583510850fad..1acfae12d689 100644
--- a/drivers/dca/dca-core.c
+++ b/drivers/dca/dca-core.c
@@ -360,16 +360,15 @@ int register_dca_provider(struct dca_provider *dca, struct device *dev)
 
 		if (dca_providers_blocked) {
 			raw_spin_unlock_irqrestore(&dca_lock, flags);
-			dca_sysfs_remove_provider(dca);
 			unregister_dca_providers();
-			return -ENODEV;
+			goto err_remove_provider;
 		}
 
 		raw_spin_unlock_irqrestore(&dca_lock, flags);
 		rc = dca_pci_rc_from_dev(dev);
 		newdomain = dca_allocate_domain(rc);
 		if (!newdomain)
-			return -ENODEV;
+			goto err_remove_provider;
 		raw_spin_lock_irqsave(&dca_lock, flags);
 		/* Recheck, we might have raced after dropping the lock */
 		domain = dca_get_domain(dev);
@@ -386,6 +385,10 @@ int register_dca_provider(struct dca_provider *dca, struct device *dev)
 				     DCA_PROVIDER_ADD, NULL);
 	kfree(newdomain);
 	return 0;
+
+err_remove_provider:
+	dca_sysfs_remove_provider(dca);
+	return -ENODEV;
 }
 EXPORT_SYMBOL_GPL(register_dca_provider);
 
-- 
2.43.0