From 0d0338afc909ddde9f8cfc6da1af6ed18d9f32b3 Mon Sep 17 00:00:00 2001
From: Conrad Meyer <cem@FreeBSD.org>
Date: Tue, 7 Jun 2016 20:26:00 +0000
Subject: [PATCH] iflib: Improve cleanup on iflib_queues_alloc error path

Fix some memory leaks.  Some may remain.

Reported by:	Coverity
Discussed with:	mmacy
CIDs:		1356036, 1356037, 1356038
Sponsored by:	EMC / Isilon Storage Division
---
 sys/net/iflib.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/sys/net/iflib.c b/sys/net/iflib.c
index b7dd3ac99cc8..955a1b261a29 100644
--- a/sys/net/iflib.c
+++ b/sys/net/iflib.c
@@ -3863,6 +3863,9 @@ iflib_queues_alloc(if_ctx_t ctx)
 	KASSERT(ntxqs > 0, ("number of queues must be at least 1"));
 	KASSERT(nrxqs > 0, ("number of queues must be at least 1"));
 
+	brscp = NULL;
+	rxq = NULL;
+
 /* Allocate the TX ring struct memory */
 	if (!(txq =
 	    (iflib_txq_t) malloc(sizeof(struct iflib_txq) *
@@ -3888,6 +3891,8 @@ iflib_queues_alloc(if_ctx_t ctx)
 
 	ctx->ifc_txqs = txq;
 	ctx->ifc_rxqs = rxq;
+	txq = NULL;
+	rxq = NULL;
 
 	/*
 	 * XXX handle allocation failure
@@ -3898,7 +3903,7 @@ iflib_queues_alloc(if_ctx_t ctx)
 		if ((ifdip = malloc(sizeof(struct iflib_dma_info) * ntxqs, M_IFLIB, M_WAITOK|M_ZERO)) == NULL) {
 			device_printf(dev, "failed to allocate iflib_dma_info\n");
 			err = ENOMEM;
-			goto fail;
+			goto err_tx_desc;
 		}
 		txq->ift_ifdi = ifdip;
 		for (j = 0; j < ntxqs; j++, ifdip++) {
@@ -3940,7 +3945,7 @@ iflib_queues_alloc(if_ctx_t ctx)
 			if (err) {
 				/* XXX free any allocated rings */
 				device_printf(dev, "Unable to allocate buf_ring\n");
-				goto fail;
+				goto err_tx_desc;
 			}
 		}
 	}
@@ -3951,7 +3956,7 @@ iflib_queues_alloc(if_ctx_t ctx)
 		if ((ifdip = malloc(sizeof(struct iflib_dma_info) * nrxqs, M_IFLIB, M_WAITOK|M_ZERO)) == NULL) {
 			device_printf(dev, "failed to allocate iflib_dma_info\n");
 			err = ENOMEM;
-			goto fail;
+			goto err_tx_desc;
 		}
 
 		rxq->ifr_ifdi = ifdip;
@@ -3975,7 +3980,7 @@ iflib_queues_alloc(if_ctx_t ctx)
 			  (iflib_fl_t) malloc(sizeof(struct iflib_fl) * nfree_lists, M_IFLIB, M_NOWAIT | M_ZERO))) {
 			device_printf(dev, "Unable to allocate free list memory\n");
 			err = ENOMEM;
-			goto fail;
+			goto err_tx_desc;
 		}
 		rxq->ifr_fl = fl;
 		for (j = 0; j < nfree_lists; j++) {
@@ -4042,10 +4047,16 @@ err_tx_desc:
 	if (ctx->ifc_rxqs != NULL)
 		free(ctx->ifc_rxqs, M_IFLIB);
 	ctx->ifc_rxqs = NULL;
-rx_fail:
 	if (ctx->ifc_txqs != NULL)
 		free(ctx->ifc_txqs, M_IFLIB);
 	ctx->ifc_txqs = NULL;
+rx_fail:
+	if (brscp != NULL)
+		free(brscp, M_IFLIB);
+	if (rxq != NULL)
+		free(rxq, M_IFLIB);
+	if (txq != NULL)
+		free(txq, M_IFLIB);
 fail:
 	return (err);
 }