virtio_balloon: Fix memory leaks on errors in virtballoon_probe()

BugLink: https://bugs.launchpad.net/bugs/1863588
commit 1ad6f58ea9364b0a5d8ae06249653ac9304a8578 upstream.

We forget to put the inode and unmount the kernfs used for compaction.

Fixes: 71994620bb25 ("virtio_balloon: replace oom notifier with shrinker")
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Wei Wang <wei.w.wang@intel.com>
Cc: Liang Li <liang.z.li@intel.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Link: https://lore.kernel.org/r/20200205163402.42627-3-david@redhat.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>

diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 90dd87ca50347777623318242296f74ebef3538c..c962d9b370c697170c0cc39956676ee1df8a0a7e 100644 (file)
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -900,8 +900,7 @@ static int virtballoon_probe(struct virtio_device *vdev)
        vb->vb_dev_info.inode = alloc_anon_inode(balloon_mnt->mnt_sb);
        if (IS_ERR(vb->vb_dev_info.inode)) {
                err = PTR_ERR(vb->vb_dev_info.inode);
-               kern_unmount(balloon_mnt);
-               goto out_del_vqs;
+               goto out_kern_unmount;
        }
        vb->vb_dev_info.inode->i_mapping->a_ops = &balloon_aops;
 #endif
@@ -912,13 +911,13 @@ static int virtballoon_probe(struct virtio_device *vdev)
                 */
                if (virtqueue_get_vring_size(vb->free_page_vq) < 2) {
                        err = -ENOSPC;
-                       goto out_del_vqs;
+                       goto out_iput;
                }
                vb->balloon_wq = alloc_workqueue("balloon-wq",
                                        WQ_FREEZABLE | WQ_CPU_INTENSIVE, 0);
                if (!vb->balloon_wq) {
                        err = -ENOMEM;
-                       goto out_del_vqs;
+                       goto out_iput;
                }
                INIT_WORK(&vb->report_free_page_work, report_free_page_func);
                vb->cmd_id_received_cache = VIRTIO_BALLOON_CMD_ID_STOP;
@@ -952,6 +951,12 @@ static int virtballoon_probe(struct virtio_device *vdev)
 out_del_balloon_wq:
        if (virtio_has_feature(vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT))
                destroy_workqueue(vb->balloon_wq);
+out_iput:
+#ifdef CONFIG_BALLOON_COMPACTION
+       iput(vb->vb_dev_info.inode);
+out_kern_unmount:
+       kern_unmount(balloon_mnt);
+#endif
 out_del_vqs:
        vdev->config->del_vqs(vdev);
 out_free_vb: