[PATCH] stm: Fix potential policy leak after device unregistration

[PATCH] stm: Fix potential policy leak after device unregistration

[Guangshuo Li]

A policy can outlive its STM device. When that happens, device teardown
has already cleared policy->stm and stp_policy_release() returns without
freeing the policy.

Only skip unbinding an already unbound policy; always free its memory.

This issue was found by our static analysis tool under development.

Fixes: 4c127fd16e6b ("stm class: Fix locking in unbinding policy path")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
 drivers/hwtracing/stm/policy.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/hwtracing/stm/policy.c b/drivers/hwtracing/stm/policy.c
index fabaf4b14889..ec0c9f4d693e 100644
--- a/drivers/hwtracing/stm/policy.c
+++ b/drivers/hwtracing/stm/policy.c
@@ -354,12 +354,11 @@ static void stp_policy_release(struct config_item *item)
 	struct stm_device *stm = policy->stm;
 
 	/* a policy *can* be unbound and still exist in configfs tree */
-	if (!stm)
-		return;
-
-	mutex_lock(&stm->policy_mutex);
-	stp_policy_unbind(policy);
-	mutex_unlock(&stm->policy_mutex);
+	if (stm) {
+		mutex_lock(&stm->policy_mutex);
+		stp_policy_unbind(policy);
+		mutex_unlock(&stm->policy_mutex);
+	}
 
 	kfree(policy);
 }

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4