iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xen/xenbus: Fix a double free in xenbus_map_ring_pv()

Browse Source 
When there is an error the caller frees "info->node" so the free here
will result in a double free.  We should just delete first kfree().

Fixes: 3848e4e0a3 ("xen/xenbus: avoid large structs and arrays on the stack")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20200710113610.GA92345@mwanda
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
This commit is contained in:
Dan Carpenter 2020-07-10 14:36:10 +03:00 committed by Boris Ostrovsky
parent 578c1bb905
commit ba8c423488
1 changed files with 1 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/xen/xenbus/xenbus_client.c
View File

@ -693,10 +693,8 @@ static int xenbus_map_ring_pv(struct xenbus_device *dev,
bool leaked;
area = alloc_vm_area(XEN_PAGE_SIZE * nr_grefs, info->ptes);
if (!area) {
kfree(node);
if (!area)
return -ENOMEM;
}
for (i = 0; i < nr_grefs; i++)
info->phys_addrs[i] =