cpuidle: Fix three reference count leaks

[ Upstream commit c343bf1ba5efcbf2266a1fe3baefec9cc82f867f ]

kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object.

Previous commit "b8eb718348b8" fixed a similar problem.

Signed-off-by: Qiushi Wu <wu000273@umn.edu>
[ rjw: Subject ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
index 9e98a5fbbc1d7fadafc7861ceae1967d8032f956..e7e92ed34f0c6262d9876fecb162ecd5c934c065 100644 (file)
--- a/drivers/cpuidle/sysfs.c
+++ b/drivers/cpuidle/sysfs.c
@@ -412,7 +412,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device)
                ret = kobject_init_and_add(&kobj->kobj, &ktype_state_cpuidle,
                                           &kdev->kobj, "state%d", i);
                if (ret) {
-                       kfree(kobj);
+                       kobject_put(&kobj->kobj);
                        goto error_state;
                }
                kobject_uevent(&kobj->kobj, KOBJ_ADD);
@@ -542,7 +542,7 @@ static int cpuidle_add_driver_sysfs(struct cpuidle_device *dev)
        ret = kobject_init_and_add(&kdrv->kobj, &ktype_driver_cpuidle,
                                   &kdev->kobj, "driver");
        if (ret) {
-               kfree(kdrv);
+               kobject_put(&kdrv->kobj);
                return ret;
        }
 
@@ -636,7 +636,7 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev)
        error = kobject_init_and_add(&kdev->kobj, &ktype_cpuidle, &cpu_dev->kobj,
                                   "cpuidle");
        if (error) {
-               kfree(kdev);
+               kobject_put(&kdev->kobj);
                return error;
        }