From: Julien Grall <julien.grall@linaro.org>
To: xen-devel@lists.xenproject.org
Cc: stefano.stabellini@citrix.com,
Julien Grall <julien.grall@linaro.org>,
tim@xen.org, ian.campbell@citrix.com
Subject: [PATCH] xen/arm: domain_vgic_init: Avoid double free on shared_irqs
Date: Fri, 25 Jul 2014 15:17:26 +0100 [thread overview]
Message-ID: <1406297847-23440-1-git-send-email-julien.grall@linaro.org> (raw)
When the function domain_vgic_init is failing to initialize pending_irqs,
it will free shared_irqs. Few call later, domain_vgic_free will be called
an try to free a second time the same variable. This will result to a double
free.
Remove the free in domain_vgic_init and rely on domain_vgic_free to correctly
release the memory.
Signed-off-by: Julien Grall <julien.grall@linaro.org>
---
This patch should be backported to Xen 4.4.
---
xen/arch/arm/vgic.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/xen/arch/arm/vgic.c b/xen/arch/arm/vgic.c
index aba613b..edbb71a 100644
--- a/xen/arch/arm/vgic.c
+++ b/xen/arch/arm/vgic.c
@@ -84,10 +84,7 @@ int domain_vgic_init(struct domain *d, unsigned int nr_spis)
d->arch.vgic.pending_irqs =
xzalloc_array(struct pending_irq, d->arch.vgic.nr_spis);
if ( d->arch.vgic.pending_irqs == NULL )
- {
- xfree(d->arch.vgic.shared_irqs);
return -ENOMEM;
- }
for (i=0; i<d->arch.vgic.nr_spis; i++)
{
--
1.7.10.4
next reply other threads:[~2014-07-25 14:17 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-07-25 14:17 Julien Grall [this message]
2014-09-08 20:47 ` [PATCH] xen/arm: domain_vgic_init: Avoid double free on shared_irqs Julien Grall
2014-09-09 11:13 ` Ian Campbell
2014-09-09 18:51 ` Julien Grall
2014-09-10 9:27 ` Ian Campbell
2014-09-10 19:04 ` Julien Grall
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1406297847-23440-1-git-send-email-julien.grall@linaro.org \
--to=julien.grall@linaro.org \
--cc=ian.campbell@citrix.com \
--cc=stefano.stabellini@citrix.com \
--cc=tim@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).