---
  drivers/virtio/virtio_ring.c | 48 +++++++++++++++++++++++++-----------
  1 file changed, 34 insertions(+), 14 deletions(-)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 10cc2b7e3588..32590d763c3b 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c

@@ -1908,6 +1908,33 @@ static int vring_alloc_queue_packed(struct vring_virtqueue_packed *vring_packed,
  	return -ENOMEM;
  }
  
+static int vring_alloc_state_extra_packed(struct vring_virtqueue_packed *vring_packed)
+{
+	struct vring_desc_state_packed *state;
+	struct vring_desc_extra *extra;
+	u32 num = vring_packed->vring.num;
+
+	state = kmalloc_array(num, sizeof(struct vring_desc_state_packed), GFP_KERNEL);
+	if (!state)
+		goto err_desc_state;
+
+	memset(state, 0, num * sizeof(struct vring_desc_state_packed));
+
+	extra = vring_alloc_desc_extra(num);
+	if (!extra)
+		goto err_desc_extra;
+
+	vring_packed->desc_state = state;
+	vring_packed->desc_extra = extra;
+
+	return 0;
+
+err_desc_extra:
+	kfree(state);
+err_desc_state:
+	return -ENOMEM;
+}
+
  static struct virtqueue *vring_create_virtqueue_packed(
  	unsigned int index,
  	unsigned int num,

@@ -1922,6 +1949,7 @@ static struct virtqueue *vring_create_virtqueue_packed(
  {
  	struct vring_virtqueue_packed vring_packed = {};
  	struct vring_virtqueue *vq;
+	int err;
  
  	if (vring_alloc_queue_packed(&vring_packed, vdev, num))
  		goto err_ring;

@@ -1961,18 +1989,12 @@ static struct virtqueue *vring_create_virtqueue_packed(
  	vq->packed.event_flags_shadow = 0;
  	vq->packed.avail_used_flags = 1 << VRING_PACKED_DESC_F_AVAIL;
  
-	vq->packed.desc_state = kmalloc_array(num,
-			sizeof(struct vring_desc_state_packed),
-			GFP_KERNEL);
-	if (!vq->packed.desc_state)
-		goto err_desc_state;
-
-	memset(vq->packed.desc_state, 0,
-		num * sizeof(struct vring_desc_state_packed));
+	err = vring_alloc_state_extra_packed(&vring_packed);
+	if (err)
+		goto err_state_extra;
  
-	vq->packed.desc_extra = vring_alloc_desc_extra(num);
-	if (!vq->packed.desc_extra)
-		goto err_desc_extra;
+	vq->packed.desc_state = vring_packed.desc_state;
+	vq->packed.desc_extra = vring_packed.desc_extra;
  
  	/* No callback?  Tell other side not to bother us. */
  	if (!callback) {

@@ -1988,9 +2010,7 @@ static struct virtqueue *vring_create_virtqueue_packed(
  	spin_unlock(&vdev->vqs_list_lock);
  	return &vq->vq;
  
-err_desc_extra:
-	kfree(vq->packed.desc_state);
-err_desc_state:
+err_state_extra:
  	kfree(vq);
  err_vq:
  	vring_free_packed(&vring_packed, vdev);