[PATCH 1/2] mtd: rawnand: fix GPIO descriptor leak in rawnand_dt_parse_gpio_cs()

[Zhao Feng]

rawnand_dt_parse_gpio_cs() acquires one GPIO descriptor per loop
iteration with gpiod_get_index_optional().  If a later iteration
fails, the descriptors acquired so far are never released, leaking
the GPIO references.

Roll back with gpiod_put() on the error path.  gpiod_put() accepts
NULL, so the NULL slots left by absent optional GPIOs need no special
casing.

Fixes: b85c943d181a ("mtd: rawnand: Add a helper to parse the gpio-cs DT property")
Cc: stable at vger.kernel.org
Signed-off-by: Zhao Feng <zhaofeng2 at cmss.chinamobile.com>
---
Verified against current upstream master.  Not runtime-tested (no
hardware using gpio-cs).

 drivers/mtd/nand/raw/nand_base.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -5466,7 +5466,7 @@ int rawnand_dt_parse_gpio_cs(struct device *dev, struct gpio_desc ***cs_array,
 			     unsigned int *ncs_array)
 {
 	struct gpio_desc **descs;
-	int ndescs, i;
+	int ndescs, i, ret;
 
 	ndescs = gpiod_count(dev, "cs");
 	if (ndescs < 0) {
@@ -5481,8 +5481,14 @@ int rawnand_dt_parse_gpio_cs(struct device *dev, struct gpio_desc ***cs_array,
 	for (i = 0; i < ndescs; i++) {
 		descs[i] = gpiod_get_index_optional(dev, "cs", i,
 						    GPIOD_OUT_HIGH);
-		if (IS_ERR(descs[i]))
-			return PTR_ERR(descs[i]);
+		if (IS_ERR(descs[i])) {
+			ret = PTR_ERR(descs[i]);
+
+			while (--i >= 0)
+				gpiod_put(descs[i]);
+
+			return ret;
+		}
 	}
 
 	*ncs_array = ndescs;
-- 
2.39.2