mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()

[ Upstream commit fc38a5a10e9e5a75eb9189854abeb8405b214cc9 ]

mmc_add_host() may return error, if we ignore its return value, the memory
that allocated in mmc_alloc_host() will be leaked and it will lead a kernel
crash because of deleting not added device in the remove path.

So fix this by checking the return value and calling mmc_free_host() in the
error path, besides, led_classdev_unregister() and pm_runtime_disable() also
need be called.

Fixes: c7f6558d84af ("mmc: Add realtek USB sdmmc host driver")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20221101063023.1664968-7-yangyingliang@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/mmc/host/rtsx_usb_sdmmc.c b/drivers/mmc/host/rtsx_usb_sdmmc.c
index 5fe4528e296e68719a196786dedc91cf25559615..1be3a355f10d546425d8788c1f37e525ecc2670c 100644 (file)
--- a/drivers/mmc/host/rtsx_usb_sdmmc.c
+++ b/drivers/mmc/host/rtsx_usb_sdmmc.c
@@ -1332,6 +1332,7 @@ static int rtsx_usb_sdmmc_drv_probe(struct platform_device *pdev)
 #ifdef RTSX_USB_USE_LEDS_CLASS
        int err;
 #endif
+       int ret;
 
        ucr = usb_get_intfdata(to_usb_interface(pdev->dev.parent));
        if (!ucr)
@@ -1368,7 +1369,15 @@ static int rtsx_usb_sdmmc_drv_probe(struct platform_device *pdev)
        INIT_WORK(&host->led_work, rtsx_usb_update_led);
 
 #endif
-       mmc_add_host(mmc);
+       ret = mmc_add_host(mmc);
+       if (ret) {
+#ifdef RTSX_USB_USE_LEDS_CLASS
+               led_classdev_unregister(&host->led);
+#endif
+               mmc_free_host(mmc);
+               pm_runtime_disable(&pdev->dev);
+               return ret;
+       }
 
        return 0;
 }