diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index d745004..abd4c51 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -736,7 +736,8 @@
 	intf = ipmi_interfaces[if_num];
 	if ((if_num >= MAX_IPMI_INTERFACES) || IPMI_INVALID_INTERFACE(intf)) {
 		spin_unlock_irqrestore(&interfaces_lock, flags);
-		return -EINVAL;
+		rv = -EINVAL;
+		goto out_kfree;
 	}
 
 	/* Note that each existing user holds a refcount to the interface. */
@@ -751,14 +752,14 @@
 
 	if (!try_module_get(intf->handlers->owner)) {
 		rv = -ENODEV;
-		goto out_err;
+		goto out_kref;
 	}
 
 	if (intf->handlers->inc_usecount) {
 		rv = intf->handlers->inc_usecount(intf->send_info);
 		if (rv) {
 			module_put(intf->handlers->owner);
-			goto out_err;
+			goto out_kref;
 		}
 	}
 
@@ -769,9 +770,10 @@
 	*user = new_user;
 	return 0;
 
- out_err:
-	kfree(new_user);
+out_kref:
 	kref_put(&intf->refcount, intf_free);
+out_kfree:
+	kfree(new_user);
 	return rv;
 }