[PATCH] firmware: arm_scmi: Free mailbox state on mapping failure

[PATCH] firmware: arm_scmi: Free mailbox state on mapping failure

[Sudeep Holla]

mailbox_chan_setup() allocates its private state from the SCMI base
device before mapping the shared-memory area. If mapping fails while
setting up an optional RX channel, the core ignores the RX failure and
keeps the base device bound, retaining that devres allocation.

Release the private mailbox state before returning the mapping error.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-fda9bcb5-8255-4157-bbf7-d720bbd86605
Fixes: 1ebc28e9357c ("firmware: arm_scmi: Introduce setup_shmem_iomap")
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
---
 drivers/firmware/arm_scmi/transports/mailbox.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/firmware/arm_scmi/transports/mailbox.c b/drivers/firmware/arm_scmi/transports/mailbox.c
index 56af2cb0f424..49c472e2ba27 100644
--- a/drivers/firmware/arm_scmi/transports/mailbox.c
+++ b/drivers/firmware/arm_scmi/transports/mailbox.c
@@ -206,8 +206,11 @@ static int mailbox_chan_setup(struct scmi_chan_info *cinfo, struct device *dev,
 
 	smbox->shmem = core->shmem->setup_iomap(cinfo, dev, tx, NULL,
 						&smbox->io_ops);
-	if (IS_ERR(smbox->shmem))
-		return PTR_ERR(smbox->shmem);
+	if (IS_ERR(smbox->shmem)) {
+		ret = PTR_ERR(smbox->shmem);
+		devm_kfree(dev, smbox);
+		return ret;
+	}
 
 	cl = &smbox->cl;
 	cl->dev = cdev;
-- 
2.43.0