xen-gntdev: Fix memory leak when mmap fails

The error path did not decrement the reference count of the grant structure.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 9694a1a8b2e269de8d1e9286029ca3b2d8bf25cf..2aa83166da323123c2ca2fd89e7616cfa41802cd 100644 (file)
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -650,15 +650,13 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
                                          find_grant_ptes, map);
                if (err) {
                        printk(KERN_WARNING "find_grant_ptes() failure.\n");
-                       return err;
+                       goto out_put_map;
                }
        }
 
        err = map_grant_pages(map);
-       if (err) {
-               printk(KERN_WARNING "map_grant_pages() failure.\n");
-               return err;
-       }
+       if (err)
+               goto out_put_map;
 
        map->is_mapped = 1;
 
@@ -667,7 +665,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
                        err = vm_insert_page(vma, vma->vm_start + i*PAGE_SIZE,
                                map->pages[i]);
                        if (err)
-                               return err;
+                               goto out_put_map;
                }
        }
 
@@ -676,6 +674,10 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
 unlock_out:
        spin_unlock(&priv->lock);
        return err;
+
+out_put_map:
+       gntdev_put_map(map);
+       return err;
 }
 
 static const struct file_operations gntdev_fops = {