On Fri, 5 Jul 2019 01:48:32 +0200, Pablo Neira Ayuso wrote: > +static int tcf_block_bind(struct tcf_block *block, struct tc_block_offload *bo) > +{ > + struct tcf_block_cb *block_cb, *next; > + int err, i = 0; > + > + list_for_each_entry(block_cb, &bo->cb_list, global_list) { > + err = tcf_block_playback_offloads(block, block_cb->cb, > + block_cb->cb_priv, true, > + tcf_block_offload_in_use(block), > + bo->extack); > + if (err) > + goto err_unroll; > + > + list_add(&block_cb->list, &block->cb_list); > + i++; > + } > + list_splice(&bo->cb_list, &tcf_block_cb_list); > + > + return 0; > + > +err_unroll: > + list_for_each_entry_safe(block_cb, next, &bo->cb_list, global_list) { > + if (i-- > 0) { > + list_del(&block_cb->list); > + tcf_block_playback_offloads(block, block_cb->cb, > + block_cb->cb_priv, false, > + tcf_block_offload_in_use(block), > + NULL); > + } > + kfree(block_cb); Is this not a tcf_block_cb_free() on purpose? > + } > + > + return err; > +}