Drivers: hv: vmbus: Fix a bug in the error path in vmbus_open()

Correctly rollback state if the failure occurs after we have handed over
the ownership of the buffer to the host.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 5 insertions, 2 deletions

diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index f6879950e131..bf0cf8f3bcaf 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -137,7 +137,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
                            GFP_KERNEL);
         if (!open_info) {
                 err = -ENOMEM;
-                goto error0;
+                goto error_gpadl;
         }
 
         init_completion(&open_info->waitevent);
@@ -153,7 +153,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
 
         if (userdatalen > MAX_USER_DEFINED_BYTES) {
                 err = -EINVAL;
-                goto error0;
+                goto error_gpadl;
         }
 
         if (userdatalen)
@@ -197,6 +197,9 @@ error1:
         list_del(&open_info->msglistentry);
         spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
 
+error_gpadl:
+        vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle);
+
 error0:
         free_pages((unsigned long)out,
                 get_order(send_ringbuffer_size + recv_ringbuffer_size));