--- /dev/null
+From 4b01732de5278618d8b013fa300638742392d507 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 19:37:48 +0800
+Subject: net: hns3: fix error handling int the hns3_get_vector_ring_chain
+
+From: Huazhong Tan <tanhuazhong@huawei.com>
+
+[ Upstream commit cda69d244585bc4497d3bb878c22fe2b6ad647c1 ]
+
+When hns3_get_vector_ring_chain() failed in the
+hns3_nic_init_vector_data(), it should do the error handling instead
+of return directly.
+
+Also, cur_chain should be freed instead of chain and head->next should
+be set to NULL in error handling of hns3_get_vector_ring_chain.
+
+This patch fixes them.
+
+Fixes: 73b907a083b8 ("net: hns3: bugfix for buffer not free problem during resetting")
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 3708f149d0a6a..2f1c4adf1734d 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -2597,9 +2597,10 @@ err_free_chain:
+ cur_chain = head->next;
+ while (cur_chain) {
+ chain = cur_chain->next;
+- devm_kfree(&pdev->dev, chain);
++ devm_kfree(&pdev->dev, cur_chain);
+ cur_chain = chain;
+ }
++ head->next = NULL;
+
+ return -ENOMEM;
+ }
+@@ -2671,7 +2672,7 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv)
+ ret = hns3_get_vector_ring_chain(tqp_vector,
+ &vector_ring_chain);
+ if (ret)
+- return ret;
++ goto map_ring_fail;
+
+ ret = h->ae_algo->ops->map_ring_to_vector(h,
+ tqp_vector->vector_irq, &vector_ring_chain);
+--
+2.20.1
+