Drivers: hv: Cleanup error handling in vmbus_open()

Fix a memory leak  in the error handling path in the function vmbus_open().

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Reported-by: Jason Wang <jasowang@redhat.com>
Cc: Stable <stable@vger.kernel.org>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 13 insertions, 11 deletions

diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index 406537420fff..f4c3d28cd1fc 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -146,14 +146,14 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
 
         if (ret != 0) {
                 err = ret;
-                goto errorout;
+                goto error0;
         }
 
         ret = hv_ringbuffer_init(
                 &newchannel->inbound, in, recv_ringbuffer_size);
         if (ret != 0) {
                 err = ret;
-                goto errorout;
+                goto error0;
         }
 
 
@@ -168,7 +168,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
 
         if (ret != 0) {
                 err = ret;
-                goto errorout;
+                goto error0;
         }
 
         /* Create and init the channel open message */
@@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
                            GFP_KERNEL);
         if (!open_info) {
                 err = -ENOMEM;
-                goto errorout;
+                goto error0;
         }
 
         init_completion(&open_info->waitevent);
@@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
 
         if (userdatalen > MAX_USER_DEFINED_BYTES) {
                 err = -EINVAL;
-                goto errorout;
+                goto error0;
         }
 
         if (userdatalen)
@@ -208,19 +208,18 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
                                sizeof(struct vmbus_channel_open_channel));
 
         if (ret != 0)
-                goto cleanup;
+                goto error1;
 
         t = wait_for_completion_timeout(&open_info->waitevent, 5*HZ);
         if (t == 0) {
                 err = -ETIMEDOUT;
-                goto errorout;
+                goto error1;
         }
 
 
         if (open_info->response.open_result.status)
                 err = open_info->response.open_result.status;
 
-cleanup:
         spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
         list_del(&open_info->msglistentry);
         spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
@@ -228,9 +227,12 @@ cleanup:
         kfree(open_info);
         return err;
 
-errorout:
-        hv_ringbuffer_cleanup(&newchannel->outbound);
-        hv_ringbuffer_cleanup(&newchannel->inbound);
+error1:
+        spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
+        list_del(&open_info->msglistentry);
+        spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
+
+error0:
         free_pages((unsigned long)out,
                 get_order(send_ringbuffer_size + recv_ringbuffer_size));
         kfree(open_info);