[PATCH] misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()

[Abdun Nihaal]

The memory allocated for struct vmci_subscription (sub) is not freed
in the error path when have_new_id is false. Fix that by adding a
kfree() call, and moving the read of sub->id to a point before freeing.

Fixes: 1d990201f9bb ("VMCI: event handling implementation.")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Abdun Nihaal <nihaal@xxxxxxxxxxxxxx>
---
Compile tested only. Issue found using static analysis.

 drivers/misc/vmw_vmci/vmci_event.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/misc/vmw_vmci/vmci_event.c b/drivers/misc/vmw_vmci/vmci_event.c
index fffe068a26eb..a7f7363c577f 100644
--- a/drivers/misc/vmw_vmci/vmci_event.c
+++ b/drivers/misc/vmw_vmci/vmci_event.c
@@ -181,14 +181,15 @@ int vmci_event_subscribe(u32 event,
 
 	if (have_new_id) {
 		list_add_rcu(&sub->node, &subscriber_array[event]);
+		*new_subscription_id = sub->id;
 		retval = VMCI_SUCCESS;
 	} else {
+		*new_subscription_id = sub->id;
+		kfree(sub);
 		retval = VMCI_ERROR_NO_RESOURCES;
 	}
 
 	mutex_unlock(&subscriber_mutex);
-
-	*new_subscription_id = sub->id;
 	return retval;
 }
 EXPORT_SYMBOL_GPL(vmci_event_subscribe);
-- 
2.43.0