瀏覽代碼

xen/pvh: Fix misplaced kfree from xlated_setup_gnttab_pages

Passing a freed 'pages' to free_xenballooned_pages will end badly
on kernels with slub debug enabled.

This looks out of place between the rc assign and the check, but
we do want to kfree pages regardless of which path we take.

Signed-off-by: Dave Jones <davej@fedoraproject.org>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Dave Jones 11 年之前
父節點
當前提交
f93576e1ac
共有 1 個文件被更改,包括 2 次插入1 次删除
  1. 2 1
      arch/x86/xen/grant-table.c

+ 2 - 1
arch/x86/xen/grant-table.c

@@ -162,14 +162,15 @@ static int __init xlated_setup_gnttab_pages(void)
 	rc = arch_gnttab_map_shared(pfns, nr_grant_frames, nr_grant_frames,
 	rc = arch_gnttab_map_shared(pfns, nr_grant_frames, nr_grant_frames,
 				    &xen_auto_xlat_grant_frames.vaddr);
 				    &xen_auto_xlat_grant_frames.vaddr);
 
 
-	kfree(pages);
 	if (rc) {
 	if (rc) {
 		pr_warn("%s Couldn't map %ld pfns rc:%d\n", __func__,
 		pr_warn("%s Couldn't map %ld pfns rc:%d\n", __func__,
 			nr_grant_frames, rc);
 			nr_grant_frames, rc);
 		free_xenballooned_pages(nr_grant_frames, pages);
 		free_xenballooned_pages(nr_grant_frames, pages);
+		kfree(pages);
 		kfree(pfns);
 		kfree(pfns);
 		return rc;
 		return rc;
 	}
 	}
+	kfree(pages);
 
 
 	xen_auto_xlat_grant_frames.pfn = pfns;
 	xen_auto_xlat_grant_frames.pfn = pfns;
 	xen_auto_xlat_grant_frames.count = nr_grant_frames;
 	xen_auto_xlat_grant_frames.count = nr_grant_frames;