The qm_get_qos_value() function calls bus_find_device_by_name() which
increases the device reference count, but fails to call put_device()
to balance the reference count and lead to a device reference leak.

Add put_device() calls in both the error path and success path to
properly balance the reference count.

Found via static analysis.

Fixes: 22d7a6c39cab ("crypto: hisilicon/qm - add pci bdf number check")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Longfang Liu <liulongfang@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

The clock obtained via devm_clk_get_enabled() is automatically managed
by devres and will be disabled and freed on driver detach. Manually
calling clk_disable_unprepare() in error path and remove function
causes double free.

Remove the manual clock cleanup in both aspeed_acry_probe()'s error
path and aspeed_acry_remove().

Fixes: 2f1cf4e50c95 ("crypto: aspeed - Add ACRY RSA driver")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Pull crypto fixes from Herbert Xu:

 - Fix zstd regression

 - Ensure ti driver algorithm are set as async

 - Revert patch disabling SHA1 in FIPS mode

 - Fix RNG set_ent null-pointer dereference

* tag 'v6.18-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: rng - Ensure set_ent is always present
  Revert "crypto: testmgr - desupport SHA-1 for FIPS 140"
  crypto: ti - Add CRYPTO_ALG_ASYNC flag to DTHEv2 AES algos
  crypto: zstd - Fix compression bug caused by truncation

Pull crypto updates from Herbert Xu:
 "Drivers:
   - Add ciphertext hiding support to ccp
   - Add hashjoin, gather and UDMA data move features to hisilicon
   - Add lz4 and lz77_only to hisilicon
   - Add xilinx hwrng driver
   - Add ti driver with ecb/cbc aes support
   - Add ring buffer idle and command queue telemetry for GEN6 in qat

  Others:
   - Use rcu_dereference_all to stop false alarms in rhashtable
   - Fix CPU number wraparound in padata"

* tag 'v6.18-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (78 commits)
  dt-bindings: rng: hisi-rng: convert to DT schema
  crypto: doc - Add explicit title heading to API docs
  hwrng: ks-sa - fix division by zero in ks_sa_rng_init
  KEYS: X.509: Fix Basic Constraints CA flag parsing
  crypto: anubis - simplify return statement in anubis_mod_init
  crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs
  crypto: hisilicon/qm - clear all VF configurations in the hardware
  crypto: hisilicon - enable error reporting again
  crypto: hisilicon/qm - mask axi error before memory init
  crypto: hisilicon/qm - invalidate queues in use
  crypto: qat - Return pointer directly in adf_ctl_alloc_resources
  crypto: aspeed - Fix dma_unmap_sg() direction
  rhashtable: Use rcu_dereference_all and rcu_dereference_all_check
  crypto: comp - Use same definition of context alloc and free ops
  crypto: omap - convert from tasklet to BH workqueue
  crypto: qat - Replace kzalloc() + copy_from_user() with memdup_user()
  crypto: caam - double the entropy delay interval for retry
  padata: WQ_PERCPU added to alloc_workqueue users
  padata: replace use of system_unbound_wq with system_dfl_wq
  crypto: cryptd - WQ_PERCPU added to alloc_workqueue users
  ...

Pull iommu updates from Joerg Roedel:

 - Inte VT-d:
    - IOMMU driver updated to the latest VT-d specification
    - Don't enable PRS if PDS isn't supported
    - Replace snprintf with scnprintf
    - Fix legacy mode page table dump through debugfs
    - Miscellaneous cleanups

 - AMD-Vi:
     - Support kdump boot when SNP is enabled

 - Apple-DART:
     - 4-level page-table support

 - RISC-V IOMMU:
     - ACPI support

 - Small number of miscellaneous cleanups and fixes

* tag 'iommu-updates-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (22 commits)
  iommu/vt-d: Disallow dirty tracking if incoherent page walk
  iommu/vt-d: debugfs: Avoid dumping context command register
  iommu/vt-d: Removal of Advanced Fault Logging
  iommu/vt-d: PRS isn't usable if PDS isn't supported
  iommu/vt-d: Remove LPIG from page group response descriptor
  iommu/vt-d: Drop unused cap_super_offset()
  iommu/vt-d: debugfs: Fix legacy mode page table dump logic
  iommu/vt-d: Replace snprintf with scnprintf in dmar_latency_snapshot()
  iommu/io-pgtable-dart: Fix off by one error in table index check
  iommu/riscv: Add ACPI support
  ACPI: scan: Add support for RISC-V in acpi_iommu_configure_id()
  ACPI: RISC-V: Add support for RIMT
  iommu/omap: Use int type to store negative error codes
  iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs
  iommu/amd: Skip enabling command/event buffers for kdump
  crypto: ccp: Skip SEV and SNP INIT for kdump boot
  iommu/amd: Reuse device table for kdump
  iommu/amd: Add support to remap/unmap IOMMU buffers for kdump
  iommu/apple-dart: Add 4-level page table support
  iommu/io-pgtable-dart: Add 4-level page table support
  ...

Add CRYPTO_ALG_ASYNC flag to DTHEv2 AES-ECB and AES-CBC algorithms so as
to properly indicate driver capabilities.

Suggested-by: Herbert Xu <herbert@gondor.apana.org.au>
Fixes: 52f641bc63a4 ("crypto: ti - Add driver for DTHE V2 AES Engine (ECB, CBC)")
Signed-off-by: T Pratham <t-pratham@ti.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Pull SoC driver updates from Arnd Bergmann:
 "Lots of platform specific updates for Qualcomm SoCs, including a new
  TEE subsystem driver for the Qualcomm QTEE firmware interface.

  Added support for the Apple A11 SoC in drivers that are shared with
  the M1/M2 series, among more updates for those.

  Smaller platform specific driver updates for Renesas, ASpeed,
  Broadcom, Nvidia, Mediatek, Amlogic, TI, Allwinner, and Freescale
  SoCs.

  Driver updates in the cache controller, memory controller and reset
  controller subsystems.

  SCMI firmware updates to add more features and improve robustness.
  This includes support for having multiple SCMI providers in a single
  system.

  TEE subsystem support for protected DMA-bufs, allowing hardware to
  access memory areas that managed by the kernel but remain inaccessible
  from the CPU in EL1/EL0"

* tag 'soc-drivers-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (139 commits)
  soc/fsl/qbman: Use for_each_online_cpu() instead of for_each_cpu()
  soc: fsl: qe: Drop legacy-of-mm-gpiochip.h header from GPIO driver
  soc: fsl: qe: Change GPIO driver to a proper platform driver
  tee: fix register_shm_helper()
  pmdomain: apple: Add "apple,t8103-pmgr-pwrstate"
  dt-bindings: spmi: Add Apple A11 and T2 compatible
  serial: qcom-geni: Load UART qup Firmware from linux side
  spi: geni-qcom: Load spi qup Firmware from linux side
  i2c: qcom-geni: Load i2c qup Firmware from linux side
  soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem
  soc: qcom: geni-se: Cleanup register defines and update copyright
  dt-bindings: qcom: se-common: Add QUP Peripheral-specific properties for I2C, SPI, and SERIAL bus
  Documentation: tee: Add Qualcomm TEE driver
  tee: qcom: enable TEE_IOC_SHM_ALLOC ioctl
  tee: qcom: add primordial object
  tee: add Qualcomm TEE driver
  tee: increase TEE_MAX_ARG_SIZE to 4096
  tee: add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF
  tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF
  tee: add close_context to TEE driver operation
  ...

Pull MFD updates from Lee Jones:
 "This round of updates contains a fair amount of new device support, a
  couple of fixes and some refactoring. The most notable additions
  include new drivers for Loongson's Security Engine, RNG and TPM, new
  drivers for TI's TPS6594 Power Button and BQ257xx Charger ICs.

  The rest of the set provides a return value check fix and a
  refactoring to use a more modern GPIO API for the VEXPRESS sysreg
  driver, the removal of a deprecated IRQ ACK function from the MC13xxx
  RTC driver and a new DT binding for the aforementioned TI BQ257xx
  charger.

  New Support & Features:
   - Add a suite of drivers for the Loongson Security Engine, including
     the core controller, a Random Number Generator (RNG) and Trusted
     Platform Module (TPM) support.
   - Introduce support for the TI TPS6594 PMIC's power button, including
     the input driver, MFD cell registration, and a system power-off
     handler.
   - Add comprehensive support for the TI BQ257xx series of charger ICs,
     including the core MFD driver and a power supply driver for the
     charger functionality.

  Improvements & Fixes:
   - Check the return value of devm_gpiochip_add_data() in the VEXPRESS
     sysreg driver to prevent potential silent failures.

  Cleanups & Refactoring:
   - Add a MAINTAINERS entry for the new Loongson Security Engine
     drivers.
   - Convert the VEXPRESS sysreg driver to use the modern generic GPIO
     chip API.

  Removals:
   - Remove the deprecated and unused mc13xxx_irq_ack() function from
     the MC13xxx RTC, input and touchscreen drivers.

  Device Tree Bindings Updates:
   - Add device tree bindings for the TI BQ25703A charger"

* tag 'mfd-next-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (69 commits)
  mfd: simple-mfd-i2c: Add compatible string for LX2160ARDB
  mfd: simple-mfd-i2c: Keep compatible strings in alphabetical order
  dt-bindings: mfd: twl: Add missing sub-nodes for TWL4030 & TWL603x
  dt-bindings: watchdog: Add SMARC-sAM67 support
  dt-bindings: mfd: tps6594: Allow gpio-line-names
  mfd: intel-lpss: Add Intel Wildcat Lake LPSS PCI IDs
  mfd: 88pm886: Add GPADC cell
  mfd: vexpress-sysreg: Use more common syntax for compound literals
  mfd: rz-mtu3: Fix MTU5 NFCR register offset
  mfd: max77705: Setup the core driver as an interrupt controller
  mfd: cs42l43: Remove IRQ masking in suspend
  mfd: cs42l43: Move IRQ enable/disable to encompass force suspend
  mfd: ls2kbmc: Add Loongson-2K BMC reset function support
  mfd: ls2kbmc: Introduce Loongson-2K BMC core driver
  mfd: bd71828, bd71815: Prepare for power-supply support
  dt-bindings: mfd: aspeed: Add AST2700 SCU compatibles
  dt-bindings: mfd: Convert aspeed,ast2400-p2a-ctrl to DT schema
  dt-bindings: mfd: fsl,mc13xxx: Add buttons node
  dt-bindings: mfd: fsl,mc13xxx: Convert txt to DT schema
  mfd: macsmc: Add "apple,t8103-smc" compatible
  ...

Pull x86 SEV and apic updates from Borislav Petkov:

 - Add functionality to provide runtime firmware updates for the non-x86
   parts of an AMD platform like the security processor (ASP) firmware,
   modules etc, for example. The intent being that these updates are
   interim, live fixups before a proper BIOS update can be attempted

 - Add guest support for AMD's Secure AVIC feature which gives encrypted
   guests the needed protection against a malicious hypervisor
   generating unexpected interrupts and injecting them into such guest,
   thus interfering with its operation in an unexpected and negative
   manner.

   The advantage of this scheme is that the guest determines which
   interrupts and when to accept them vs leaving that to the benevolence
   (or not) of the hypervisor

 - Strictly separate the startup code from the rest of the kernel where
   former is executed from the initial 1:1 mapping of memory.

   The problem was that the toolchain-generated version of the code was
   being executed from a different mapping of memory than what was
   "assumed" during code generation, needing an ever-growing pile of
   fixups for absolute memory references which are invalid in the early,
   1:1 memory mapping during boot.

   The major advantage of this is that there's no need to check the 1:1
   mapping portion of the code for absolute relocations anymore and get
   rid of the RIP_REL_REF() macro sprinkling all over the place.

   For more info, see Ard's very detailed writeup on this [1]

 - The usual cleanups and fixes

Link: https://lore.kernel.org/r/CAMj1kXEzKEuePEiHB%2BHxvfQbFz0sTiHdn4B%2B%2BzVBJ2mhkPkQ4Q@mail.gmail.com [1]

* tag 'x86_apic_for_v6.18_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (49 commits)
  x86/boot: Drop erroneous __init annotation from early_set_pages_state()
  crypto: ccp - Add AMD Seamless Firmware Servicing (SFS) driver
  crypto: ccp - Add new HV-Fixed page allocation/free API
  x86/sev: Add new dump_rmp parameter to snp_leak_pages() API
  x86/startup/sev: Document the CPUID flow in the boot #VC handler
  objtool: Ignore __pi___cfi_ prefixed symbols
  x86/sev: Zap snp_abort()
  x86/apic/savic: Do not use snp_abort()
  x86/boot: Get rid of the .head.text section
  x86/boot: Move startup code out of __head section
  efistub/x86: Remap inittext read-execute when needed
  x86/boot: Create a confined code area for startup code
  x86/kbuild: Incorporate boot/startup/ via Kbuild makefile
  x86/boot: Revert "Reject absolute references in .head.text"
  x86/boot: Check startup code for absence of absolute relocations
  objtool: Add action to check for absence of absolute relocations
  x86/sev: Export startup routines for later use
  x86/sev: Move __sev_[get|put]_ghcb() into separate noinstr object
  x86/sev: Provide PIC aliases for SEV related data objects
  x86/boot: Provide PIC aliases for 5-level paging related constants
  ...

Pull crypto library updates from Eric Biggers:

 - Add a RISC-V optimized implementation of Poly1305. This code was
   written by Andy Polyakov and contributed by Zhihang Shao.

 - Migrate the MD5 code into lib/crypto/, and add KUnit tests for MD5.

   Yes, it's still the 90s, and several kernel subsystems are still
   using MD5 for legacy use cases. As long as that remains the case,
   it's helpful to clean it up in the same way as I've been doing for
   other algorithms.

   Later, I plan to convert most of these users of MD5 to use the new
   MD5 library API instead of the generic crypto API.

 - Simplify the organization of the ChaCha, Poly1305, BLAKE2s, and
   Curve25519 code.

   Consolidate these into one module per algorithm, and centralize the
   configuration and build process. This is the same reorganization that
   has already been successful for SHA-1 and SHA-2.

 - Remove the unused crypto_kpp API for Curve25519.

 - Migrate the BLAKE2s and Curve25519 self-tests to KUnit.

 - Always enable the architecture-optimized BLAKE2s code.

* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (38 commits)
  crypto: md5 - Implement export_core() and import_core()
  wireguard: kconfig: simplify crypto kconfig selections
  lib/crypto: tests: Enable Curve25519 test when CRYPTO_SELFTESTS
  lib/crypto: curve25519: Consolidate into single module
  lib/crypto: curve25519: Move a couple functions out-of-line
  lib/crypto: tests: Add Curve25519 benchmark
  lib/crypto: tests: Migrate Curve25519 self-test to KUnit
  crypto: curve25519 - Remove unused kpp support
  crypto: testmgr - Remove curve25519 kpp tests
  crypto: x86/curve25519 - Remove unused kpp support
  crypto: powerpc/curve25519 - Remove unused kpp support
  crypto: arm/curve25519 - Remove unused kpp support
  crypto: hisilicon/hpre - Remove unused curve25519 kpp support
  lib/crypto: tests: Add KUnit tests for BLAKE2s
  lib/crypto: blake2s: Consolidate into single C translation unit
  lib/crypto: blake2s: Move generic code into blake2s.c
  lib/crypto: blake2s: Always enable arch-optimized BLAKE2s code
  lib/crypto: blake2s: Remove obsolete self-test
  lib/crypto: x86/blake2s: Reduce size of BLAKE2S_SIGMA2
  lib/crypto: chacha: Consolidate into single module
  ...