Skip to contentSkip to conversation

xen/xenbus: Fix a double free in xenbus_map_ring_pv()

PATCH Applied Dan Carpenter 3 participants 3 messages Jul 10, 2020

Subsystems (2)
Kernel janitors Xen hypervisor interface
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 xen/xenbus: Fix a double free in xenbus_map_ring_pv()

When there is an error the caller frees "info->node" so the free here will result in a double free. We should just delete first kfree().

Fixes 3848e4e0a32a ("xen/xenbus: avoid large structs and arrays on the stack")
Signed-off-by Dan Carpenter <[email protected]>
---
 drivers/xen/xenbus/xenbus_client.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/xen/xenbus/xenbus_client.c +1 -3
index 4f168b46fbca..786fbb7d8be0 100644
@@ -693,10 +693,8 @@ static int xenbus_map_ring_pv(struct xenbus_device *dev,
 	bool leaked;
 
 	area = alloc_vm_area(XEN_PAGE_SIZE * nr_grefs, info->ptes);
-	if (!area) {
-		kfree(node);
+	if (!area)
 		return -ENOMEM;
-	}
 
 	for (i = 0; i < nr_grefs; i++)
 		info->phys_addrs[i] --

2.27.0

maintainer Reviewed-by on v1 1/1
#1 lore raw
Quoted 5 lines · Dan Carpenter

When there is an error the caller frees "info->node" so the free here will result in a double free. We should just delete first kfree().

Fixes 3848e4e0a32a ("xen/xenbus: avoid large structs and arrays on the stack")
Signed-off-by Dan Carpenter <[email protected]>

Thanks for spotting this!

Reviewed-by Juergen Gross <[email protected]>

Juergen

Applied
#2 lore raw
Quoted 11 lines · Jürgen Groß
Quoted 6 lines · Dan Carpenter

When there is an error the caller frees "info->node" so the free here will result in a double free.  We should just delete first kfree().

Fixes 3848e4e0a32a ("xen/xenbus: avoid large structs and arrays on

the stack")

Signed-off-by Dan Carpenter <[email protected]>

Thanks for spotting this!

Reviewed-by Juergen Gross <[email protected]>

Applied to for-linus-5.8b

-boris