virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed()

[ Upstream commit ae93d8ea0fa701e84ab9df0db9fb60ec6c80d7b8 ]

There is a copy and paste bug in the error handling of this code and
it uses "ring_dma_addr" three times instead of "device_event_dma_addr"
and "driver_event_dma_addr".

Fixes: 1ce9e6055fa0 (" virtio_ring: introduce packed ring support")
Reported-by: Robert Buhren <robert.buhren@sect.tu-berlin.de>
Reported-by: Felicitas Hetzelt <file@sect.tu-berlin.de>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/X8pGRJlEzyn+04u2@mwanda
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index becc776979602bf1a408ffa1be6f2680b69605cd..924b6b85376bd9ca86ee05f806f242c1b3882a2c 100644 (file)
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -1676,9 +1676,9 @@ err_desc_extra:
 err_desc_state:
        kfree(vq);
 err_vq:
-       vring_free_queue(vdev, event_size_in_bytes, device, ring_dma_addr);
+       vring_free_queue(vdev, event_size_in_bytes, device, device_event_dma_addr);
 err_device:
-       vring_free_queue(vdev, event_size_in_bytes, driver, ring_dma_addr);
+       vring_free_queue(vdev, event_size_in_bytes, driver, driver_event_dma_addr);
 err_driver:
        vring_free_queue(vdev, ring_size_in_bytes, ring, ring_dma_addr);
 err_ring: