NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()

ntb_epf_init_isr() requests multiple MSI/MSI-X vectors in a loop. If
request_irq() fails part-way through, it jumps straight to
pci_free_irq_vectors() without freeing already requested IRQs.

Fix the error path by freeing any successfully requested IRQs before
releasing the vectors.

Fixes: 812ce2f8d14e ("NTB: Add support for EPF PCI Non-Transparent Bridge")
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Cc: stable@vger.kernel.org # v5.12+
Link: https://patch.msgid.link/20260304083028.1391068-2-den@valinux.co.jp

diff --git a/drivers/ntb/hw/epf/ntb_hw_epf.c b/drivers/ntb/hw/epf/ntb_hw_epf.c
index d3ecf25a516253e4e774e3bd835745509ef128ba..5a35f341f82137ab944306ed6b39b1a05488d0a6 100644 (file)
--- a/drivers/ntb/hw/epf/ntb_hw_epf.c
+++ b/drivers/ntb/hw/epf/ntb_hw_epf.c
@@ -355,7 +355,7 @@ static int ntb_epf_init_isr(struct ntb_epf_dev *ndev, int msi_min, int msi_max)
                                  0, "ntb_epf", ndev);
                if (ret) {
                        dev_err(dev, "Failed to request irq\n");
-                       goto err_request_irq;
+                       goto err_free_irq;
                }
        }
 
@@ -365,16 +365,14 @@ static int ntb_epf_init_isr(struct ntb_epf_dev *ndev, int msi_min, int msi_max)
                                   argument | irq);
        if (ret) {
                dev_err(dev, "Failed to configure doorbell\n");
-               goto err_configure_db;
+               goto err_free_irq;
        }
 
        return 0;
 
-err_configure_db:
-       for (i = 0; i < ndev->db_count + 1; i++)
+err_free_irq:
+       while (i--)
                free_irq(pci_irq_vector(pdev, i), ndev);
-
-err_request_irq:
        pci_free_irq_vectors(pdev);
 
        return ret;