[S390] cio: Correct cleanup on error.

Fix cleanup on error in chp_new() and init_channel_subsystem()
(must not call kfree() on structures that had been registered).

Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

2 files changed, 22 insertions, 17 deletions

diff --git a/drivers/s390/cio/chp.c b/drivers/s390/cio/chp.c
index db00b0591733..f1216cf6fa8f 100644
--- a/drivers/s390/cio/chp.c
+++ b/drivers/s390/cio/chp.c
@@ -423,7 +423,7 @@ int chp_new(struct chp_id chpid)
         ret = sysfs_create_group(&chp->dev.kobj, &chp_attr_group);
         if (ret) {
                 device_unregister(&chp->dev);
-                goto out_free;
+                goto out;
         }
         mutex_lock(&channel_subsystems[chpid.cssid]->mutex);
         if (channel_subsystems[chpid.cssid]->cm_enabled) {
@@ -432,14 +432,15 @@ int chp_new(struct chp_id chpid)
                         sysfs_remove_group(&chp->dev.kobj, &chp_attr_group);
                         device_unregister(&chp->dev);
                         mutex_unlock(&channel_subsystems[chpid.cssid]->mutex);
-                        goto out_free;
+                        goto out;
                 }
         }
         channel_subsystems[chpid.cssid]->chps[chpid.id] = chp;
         mutex_unlock(&channel_subsystems[chpid.cssid]->mutex);
-        return ret;
+        goto out;
 out_free:
         kfree(chp);
+out:
         return ret;
 }
 
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 51489eff6b0b..1261e1a9e8cd 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -633,6 +633,11 @@ channel_subsystem_release(struct device *dev)
 
         css = to_css(dev);
         mutex_destroy(&css->mutex);
+        if (css->pseudo_subchannel) {
+                /* Implies that it has been generated but never registered. */
+                css_subchannel_release(&css->pseudo_subchannel->dev);
+                css->pseudo_subchannel = NULL;
+        }
         kfree(css);
 }
 
@@ -785,11 +790,15 @@ init_channel_subsystem (void)
                 }
                 channel_subsystems[i] = css;
                 ret = setup_css(i);
-                if (ret)
-                        goto out_free;
+                if (ret) {
+                        kfree(channel_subsystems[i]);
+                        goto out_unregister;
+                }
                 ret = device_register(&css->device);
-                if (ret)
-                        goto out_free_all;
+                if (ret) {
+                        put_device(&css->device);
+                        goto out_unregister;
+                }
                 if (css_chsc_characteristics.secm) {
                         ret = device_create_file(&css->device,
                                                  &dev_attr_cm_enable);
@@ -802,7 +811,7 @@ init_channel_subsystem (void)
         }
         ret = register_reboot_notifier(&css_reboot_notifier);
         if (ret)
-                goto out_pseudo;
+                goto out_unregister;
         css_init_done = 1;
 
         /* Enable default isc for I/O subchannels. */
@@ -810,18 +819,12 @@ init_channel_subsystem (void)
 
         for_each_subchannel(__init_channel_subsystem, NULL);
         return 0;
-out_pseudo:
-        device_unregister(&channel_subsystems[i]->pseudo_subchannel->dev);
 out_file:
-        device_remove_file(&channel_subsystems[i]->device,
-                           &dev_attr_cm_enable);
+        if (css_chsc_characteristics.secm)
+                device_remove_file(&channel_subsystems[i]->device,
+                                   &dev_attr_cm_enable);
 out_device:
         device_unregister(&channel_subsystems[i]->device);
-out_free_all:
-        kfree(channel_subsystems[i]->pseudo_subchannel->lock);
-        kfree(channel_subsystems[i]->pseudo_subchannel);
-out_free:
-        kfree(channel_subsystems[i]);
 out_unregister:
         while (i > 0) {
                 struct channel_subsystem *css;
@@ -829,6 +832,7 @@ out_unregister:
                 i--;
                 css = channel_subsystems[i];
                 device_unregister(&css->pseudo_subchannel->dev);
+                css->pseudo_subchannel = NULL;
                 if (css_chsc_characteristics.secm)
                         device_remove_file(&css->device,
                                            &dev_attr_cm_enable);