[S390] cio: fix double free in case of probe failure

io_subchannel_probe() frees memory for sch->private which is later
freed again when io_subchannel_remove() is called. Fix this problem
by removing the cleanup in io_subchannel_probe().

Signed-off-by: Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 2490b741e16a25e28f4e30755ef002baede385b1..55f997308e42bf713ea01b7773139d9fd12d035d 100644 (file)
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1292,7 +1292,7 @@ static int io_subchannel_probe(struct subchannel *sch)
        sch->private = kzalloc(sizeof(struct io_subchannel_private),
                               GFP_KERNEL | GFP_DMA);
        if (!sch->private)
-               goto out_err;
+               goto out_schedule;
        /*
         * First check if a fitting device may be found amongst the
         * disconnected devices or in the orphanage.
@@ -1317,7 +1317,7 @@ static int io_subchannel_probe(struct subchannel *sch)
        }
        cdev = io_subchannel_create_ccwdev(sch);
        if (IS_ERR(cdev))
-               goto out_err;
+               goto out_schedule;
        rc = io_subchannel_recog(cdev, sch);
        if (rc) {
                spin_lock_irqsave(sch->lock, flags);
@@ -1325,9 +1325,7 @@ static int io_subchannel_probe(struct subchannel *sch)
                spin_unlock_irqrestore(sch->lock, flags);
        }
        return 0;
-out_err:
-       kfree(sch->private);
-       sysfs_remove_group(&sch->dev.kobj, &io_subchannel_attr_group);
+
 out_schedule:
        io_subchannel_schedule_removal(sch);
        return 0;
@@ -1341,13 +1339,14 @@ io_subchannel_remove (struct subchannel *sch)
 
        cdev = sch_get_cdev(sch);
        if (!cdev)
-               return 0;
+               goto out_free;
        /* Set ccw device to not operational and drop reference. */
        spin_lock_irqsave(cdev->ccwlock, flags);
        sch_set_cdev(sch, NULL);
        cdev->private->state = DEV_STATE_NOT_OPER;
        spin_unlock_irqrestore(cdev->ccwlock, flags);
        ccw_device_unregister(cdev);
+out_free:
        kfree(sch->private);
        sysfs_remove_group(&sch->dev.kobj, &io_subchannel_attr_group);
        return 0;