phy: core: Fix error path in phy_create()

Prevent resources from being freed twice in case device_add() call
fails within phy_create(). Also use ida_simple_remove() instead of
ida_remove() as we had used ida_simple_get() to allocate the ida.

Cc: 3.13+ <stable@vger.kernel.org> # 3.13+
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 4 insertions, 3 deletions

diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index c64a2f3b2d62..49c446530101 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -614,8 +614,9 @@ struct phy *phy_create(struct device *dev, const struct phy_ops *ops,
         return phy;
 
 put_dev:
-        put_device(&phy->dev);
-        ida_remove(&phy_ida, phy->id);
+        put_device(&phy->dev);  /* calls phy_release() which frees resources */
+        return ERR_PTR(ret);
+
 free_phy:
         kfree(phy);
         return ERR_PTR(ret);
@@ -799,7 +800,7 @@ static void phy_release(struct device *dev)
 
         phy = to_phy(dev);
         dev_vdbg(dev, "releasing '%s'\n", dev_name(dev));
-        ida_remove(&phy_ida, phy->id);
+        ida_simple_remove(&phy_ida, phy->id);
         kfree(phy);
 }