device_register() always calls device_initialize() so calling device_del() is safe even if device_register() fails. Implement the following advice from the comment block above device_register(): "NOTE: _Never_ directly free @dev after calling this function, even if it returned an error! Always use put_device() to give up the reference initialized in this function instead." Keep the kfree() call in the error path since srp_release_dev() does not free the host.

Cc: stable@vger.kernel.org Signed-off-by: Bart Van Assche bvanassche@acm.org --- drivers/infiniband/ulp/srp/ib_srp.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 7720ea270ed8..8fd6a88f7a9c 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -3909,20 +3909,19 @@ static struct srp_host *srp_add_port(struct srp_device *device, u8 port) port);

if (device_register(&host->dev)) - goto free_host; + goto put_host; if (device_create_file(&host->dev, &dev_attr_add_target)) - goto err_class; + goto put_host; if (device_create_file(&host->dev, &dev_attr_ibdev)) - goto err_class; + goto put_host; if (device_create_file(&host->dev, &dev_attr_port)) - goto err_class; + goto put_host;

return host;

-err_class: - device_unregister(&host->dev); - -free_host: +put_host: + device_del(&host->dev); + put_device(&host->dev); kfree(host);

return NULL;