[PATCH] dmaengine: idxd: Free the minor number when cdev setup fails

[PATCH] dmaengine: idxd: Free the minor number when cdev setup fails

[SeungUk Nam]

idxd_wq_add_cdev() allocates a minor number from cdev_ctx->minor_ida for
the new struct idxd_cdev. When dev_set_name() or cdev_device_add()
fails, the error path calls put_device(), and the release callback
idxd_cdev_dev_release() only frees idxd_cdev, so the minor number is
never returned to the ida. Leaked numbers accumulate across bind/unbind
cycles, up to MINORMASK, for as long as the module stays loaded.

Free the minor number before put_device() drops the last reference on
that path.

Fixes: c311f5e92484 ("dmaengine: idxd: Fix freeing the allocated ida too late")
Signed-off-by: SeungUk Nam <tmddnr49449@gmail.com>
---

Found by code inspection; the error path was not exercised at runtime.

 drivers/dma/idxd/cdev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/idxd/cdev.c b/drivers/dma/idxd/cdev.c
index 82b07cf942ef..f1af7f0d25d3 100644
--- a/drivers/dma/idxd/cdev.c
+++ b/drivers/dma/idxd/cdev.c
@@ -573,6 +573,7 @@ int idxd_wq_add_cdev(struct idxd_wq *wq)
 	return 0;
 
  err:
+	ida_free(&cdev_ctx->minor_ida, minor);
 	put_device(dev);
 	wq->idxd_cdev = NULL;
 	return rc;
-- 
2.34.1