[PATCH 2/2] io_uring: free ctx->sq_ring if array size overflow detected in io_allocate_scq_urings

[Shenghui Wang <shhuiw@xxxxxxxxxxx>]

Free ctx->sq_ring before return -EOVERFLOW.

Signed-off-by: Shenghui Wang <shhuiw@xxxxxxxxxxx>
---
 fs/io_uring.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 9d382ac27e63..6e1d22cbb029 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2743,8 +2743,10 @@ static int io_allocate_scq_urings(struct io_ring_ctx *ctx,
 	ctx->sq_mask = sq_ring->ring_mask;
 
 	size = array_size(sizeof(struct io_uring_sqe), p->sq_entries);
-	if (size == SIZE_MAX)
+	if (size == SIZE_MAX) {
+		io_mem_free(ctx->sq_ring);
 		return -EOVERFLOW;
+	}
 
 	ctx->sq_sqes = io_mem_alloc(size);
 	if (!ctx->sq_sqes) {
-- 
2.20.1