[PATCH 1/4] accel/habanalabs: fix ctx refcount leak in hl_direct_io() on vzalloc failure

[Wentao Liang]

hl_direct_io() takes a reference on the context through
hl_dio_get_iopath() before allocating the bio vector.  If vzalloc()
fails, the function returns -ENOMEM directly instead of going through
the cleanup label, so the context reference taken by
hl_dio_get_iopath() is never released by hl_dio_put_iopath() (and the
inflight IO counter is left incremented).

Jump to the cleanup label so the iopath reference is dropped and the
counter balanced on the failure path too.

Fixes: 8cbacc9a2703 ("accel/habanalabs: add NVMe Direct I/O (HLDIO) infrastructure")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/accel/habanalabs/common/hldio.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/accel/habanalabs/common/hldio.c b/drivers/accel/habanalabs/common/hldio.c
index c33c817a962a..0577dd8ec59d 100644
--- a/drivers/accel/habanalabs/common/hldio.c
+++ b/drivers/accel/habanalabs/common/hldio.c
@@ -248,8 +248,10 @@ static ssize_t hl_direct_io(struct hl_device *hdev, struct hl_direct_io *io)
 	 * closest one.
 	 */
 	io->bv = vzalloc(npages * sizeof(struct bio_vec));
-	if (!io->bv)
-		return -ENOMEM;
+	if (!io->bv) {
+		rc = -ENOMEM;
+		goto cleanup;
+	}
 
 	for (i = 0, device_va = io->device_va; i < npages ; ++i, device_va += PAGE_SIZE) {
 		io->bv[i].bv_page = hl_dio_va2page(hdev, io->f.ctx, device_va);
-- 
2.34.1