staging: ion: Fix error handling in ion_buffer_create

This patch fixes error handling case when buffer->pages allocation
fails. Also, it removes unreachable code of checking ret variable
although it is not updated.

Signed-off-by: Rohit kumar <rohit.kr@samsung.com>
Reviewed-by: Laura Abbott <labbott@redhat.com>
Suggested-by: Pintu Kumar <pintu.k@samsung.com>
Reviewed-by: Pintu Kumar <pintu.k@samsung.com>
Reviewed-by: Gioh Kim <gioh.kim@lge.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
index df3539865fb4ac4af4f2bf97850156719e81a3fd..91b9b75e41da8cc5338910e65d385db9ec10db26 100644 (file)
--- a/drivers/staging/android/ion/ion.c
+++ b/drivers/staging/android/ion/ion.c
@@ -213,10 +213,10 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap,
                        "heap->ops->map_dma should return ERR_PTR on error"))
                table = ERR_PTR(-EINVAL);
        if (IS_ERR(table)) {
-               heap->ops->free(buffer);
-               kfree(buffer);
-               return ERR_CAST(table);
+               ret = -EINVAL;
+               goto err1;
        }
+
        buffer->sg_table = table;
        if (ion_buffer_fault_user_mappings(buffer)) {
                int num_pages = PAGE_ALIGN(buffer->size) / PAGE_SIZE;
@@ -226,7 +226,7 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap,
                buffer->pages = vmalloc(sizeof(struct page *) * num_pages);
                if (!buffer->pages) {
                        ret = -ENOMEM;
-                       goto err1;
+                       goto err;
                }
 
                for_each_sg(table->sgl, sg, table->nents, i) {
@@ -235,9 +235,6 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap,
                        for (j = 0; j < sg->length / PAGE_SIZE; j++)
                                buffer->pages[k++] = page++;
                }
-
-               if (ret)
-                       goto err;
        }
 
        buffer->dev = dev;
@@ -263,9 +260,8 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap,
 
 err:
        heap->ops->unmap_dma(heap, buffer);
-       heap->ops->free(buffer);
 err1:
-       vfree(buffer->pages);
+       heap->ops->free(buffer);
 err2:
        kfree(buffer);
        return ERR_PTR(ret);