Swap the calling sequence of krealloc() and __request_region(), call the latter first. In this way, the value of dev_dax->nr_range does not need to be considered when __request_region() failed. Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com&gt; --- drivers/dax/bus.c | 29 ++++++++++++----------------- 1 file changed, 12 insertions(+), 17 deletions(-) diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c index 27513d311242..1efae11d947a 100644 --- a/drivers/dax/bus.c +++ b/drivers/dax/bus.c @@ -763,23 +763,15 @@ static int alloc_dev_dax_range(struct dev_dax *dev_dax, u64 start, return 0; } - ranges = krealloc(dev_dax->ranges, sizeof(*ranges) - * (dev_dax->nr_range + 1), GFP_KERNEL); - if (!ranges) - return -ENOMEM; - alloc = __request_region(res, start, size, dev_name(dev), 0); - if (!alloc) { - /* - * If this was an empty set of ranges nothing else - * will release @ranges, so do it now. - */ - if (!dev_dax->nr_range) { - kfree(ranges); - ranges = NULL; - } - dev_dax->ranges = ranges; + if (!alloc) return -ENOMEM; + + ranges = krealloc(dev_dax->ranges, sizeof(*ranges) + * (dev_dax->nr_range + 1), GFP_KERNEL); + if (!ranges) { + rc = -ENOMEM; + goto err; } for (i = 0; i < dev_dax->nr_range; i++) @@ -808,11 +800,14 @@ static int alloc_dev_dax_range(struct dev_dax *dev_dax, u64 start, dev_dbg(dev, "delete range[%d]: %pa:%pa\n", dev_dax->nr_range - 1, &alloc->start, &alloc->end); dev_dax->nr_range--; - __release_region(res, alloc->start, resource_size(alloc)); - return rc; + goto err; } return 0; + +err: + __release_region(res, alloc->start, resource_size(alloc)); + return rc; } static int adjust_dev_dax_range(struct dev_dax *dev_dax, struct resource *res, resource_size_t size) -- 2.26.0.106.g9fadedd