Skip to content

Commit ba8c423

Browse files
Dan Carpenterbostrovs
authored andcommitted
xen/xenbus: Fix a double free in xenbus_map_ring_pv()
When there is an error the caller frees "info->node" so the free here will result in a double free. We should just delete first kfree(). Fixes: 3848e4e ("xen/xenbus: avoid large structs and arrays on the stack") Signed-off-by: Dan Carpenter <[email protected]> Link: https://lore.kernel.org/r/20200710113610.GA92345@mwanda Reviewed-by: Juergen Gross <[email protected]> Signed-off-by: Boris Ostrovsky <[email protected]>
1 parent 578c1bb commit ba8c423

File tree

1 file changed

+1
-3
lines changed

1 file changed

+1
-3
lines changed

drivers/xen/xenbus/xenbus_client.c

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -693,10 +693,8 @@ static int xenbus_map_ring_pv(struct xenbus_device *dev,
693693
bool leaked;
694694

695695
area = alloc_vm_area(XEN_PAGE_SIZE * nr_grefs, info->ptes);
696-
if (!area) {
697-
kfree(node);
696+
if (!area)
698697
return -ENOMEM;
699-
}
700698

701699
for (i = 0; i < nr_grefs; i++)
702700
info->phys_addrs[i] =

0 commit comments

Comments
 (0)