From d4dae2b1fb44e0205238cd5b1ec8bac2cd72d74d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= <royger@FreeBSD.org>
Date: Thu, 11 Feb 2016 11:53:32 +0000
Subject: [PATCH] xen-netfront: rearrange error paths in setup_txqs

Coverity spotted double free errors in error path. Fix that by
removing the extraneous calls.

Coverity ID:		1349798
Submitted by:		Wei Liu <wei.liu2@citrix.com>
Reviewed by:		royger
Sponsored by:		Citrix Systems R&D
Differential revision:	https://reviews.freebsd.org/D5251
---
 sys/dev/xen/netfront/netfront.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/sys/dev/xen/netfront/netfront.c b/sys/dev/xen/netfront/netfront.c
index 89aef6298b2f..296c940f0836 100644
--- a/sys/dev/xen/netfront/netfront.c
+++ b/sys/dev/xen/netfront/netfront.c
@@ -906,11 +906,9 @@ setup_txqs(device_t dev, struct netfront_info *info,
 fail_bind_port:
 	taskqueue_drain_all(txq->tq);
 fail_start_thread:
-	gnttab_free_grant_references(txq->gref_head);
-	free(txq->ring.sring, M_DEVBUF);
-	gnttab_end_foreign_access_ref(txq->ring_ref);
 	buf_ring_free(txq->br, M_DEVBUF);
 	taskqueue_free(txq->tq);
+	gnttab_end_foreign_access_ref(txq->ring_ref);
 fail_grant_ring:
 	gnttab_free_grant_references(txq->gref_head);
 	free(txq->ring.sring, M_DEVBUF);