PCI: Fix pci_create_slot() reference count leak

kobject_init_and_add() takes a reference even when it fails.  If it returns
an error, kobject_put() must be called to clean up the memory associated
with the object.

When kobject_init_and_add() fails, call kobject_put() instead of kfree().

b8eb718348b8 ("net-sysfs: Fix reference count leak in
rx|netdev_queue_add_kobject") fixed a similar problem.

Link: https://lore.kernel.org/r/20200528021322.1984-1-wu000273@umn.edu
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>

diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
index cc386ef2fa122a39ba1433749e7da33c3aa68e62..3861505741e6d5104e3d3a4b8a02ae576d0df104 100644 (file)
--- a/drivers/pci/slot.c
+++ b/drivers/pci/slot.c
@@ -268,13 +268,16 @@ placeholder:
        slot_name = make_slot_name(name);
        if (!slot_name) {
                err = -ENOMEM;
+               kfree(slot);
                goto err;
        }
 
        err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL,
                                   "%s", slot_name);
-       if (err)
+       if (err) {
+               kobject_put(&slot->kobj);
                goto err;
+       }
 
        INIT_LIST_HEAD(&slot->list);
        list_add(&slot->list, &parent->slots);
@@ -293,7 +296,6 @@ out:
        mutex_unlock(&pci_slot_mutex);
        return slot;
 err:
-       kfree(slot);
        slot = ERR_PTR(err);
        goto out;
 }