tcm_fc: Do not free tpg structure during wq allocation failure

Avoid freeing a registered tpg structure if an alloc_workqueue call
fails.  This fixes a bug where the failure was leaking memory associated
with se_portal_group setup during the original core_tpg_register() call.

Signed-off-by: Mark Rustad <mark.d.rustad@intel.com>
Acked-by: Kiran Patil <Kiran.patil@intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

1 files changed, 8 insertions, 5 deletions

diff --git a/drivers/target/tcm_fc/tfc_conf.c b/drivers/target/tcm_fc/tfc_conf.c
index f357039349ba..2948dc944619 100644
--- a/drivers/target/tcm_fc/tfc_conf.c
+++ b/drivers/target/tcm_fc/tfc_conf.c
@@ -300,6 +300,7 @@ static struct se_portal_group *ft_add_tpg(
 {
         struct ft_lport_acl *lacl;
         struct ft_tpg *tpg;
+        struct workqueue_struct *wq;
         unsigned long index;
         int ret;
 
@@ -321,18 +322,20 @@ static struct se_portal_group *ft_add_tpg(
         tpg->lport_acl = lacl;
         INIT_LIST_HEAD(&tpg->lun_list);
 
-        ret = core_tpg_register(&ft_configfs->tf_ops, wwn, &tpg->se_tpg,
-                                tpg, TRANSPORT_TPG_TYPE_NORMAL);
-        if (ret < 0) {
+        wq = alloc_workqueue("tcm_fc", 0, 1);
+        if (!wq) {
                 kfree(tpg);
                 return NULL;
         }
 
-        tpg->workqueue = alloc_workqueue("tcm_fc", 0, 1);
-        if (!tpg->workqueue) {
+        ret = core_tpg_register(&ft_configfs->tf_ops, wwn, &tpg->se_tpg,
+                                tpg, TRANSPORT_TPG_TYPE_NORMAL);
+        if (ret < 0) {
+                destroy_workqueue(wq);
                 kfree(tpg);
                 return NULL;
         }
+        tpg->workqueue = wq;
 
         mutex_lock(&ft_lport_lock);
         list_add_tail(&tpg->list, &lacl->tpg_list);