Re: [Xen-devel] [PATCH] xen/arm: domain_vgic_init: Avoid double free on shared_irqs

[Ian Campbell <Ian.Campbell@xxxxxxxxxx>]

Sorry, this one wasn't in my queue foirld for some reason. Acked +
applied.

On Mon, 2014-09-08 at 13:47 -0700, Julien Grall wrote:
> Hi Ian and Stefano,
> 
> Ping?
> 
> On 25/07/14 07:17, Julien Grall wrote:
> > When the function domain_vgic_init is failing to initialize pending_irqs,
> > it will free shared_irqs. Few call later, domain_vgic_free will be called
> > an try to free a second time the same variable. This will result to a double
> > free.
> >
> > Remove the free in domain_vgic_init and rely on domain_vgic_free to 
> > correctly
> > release the memory.
> >
> > Signed-off-by: Julien Grall <julien.grall@xxxxxxxxxx>
> >
> > ---
> >
> > This patch should be backported to Xen 4.4.
> > ---
> >   xen/arch/arm/vgic.c |    3 ---
> >   1 file changed, 3 deletions(-)
> >
> > diff --git a/xen/arch/arm/vgic.c b/xen/arch/arm/vgic.c
> > index aba613b..edbb71a 100644
> > --- a/xen/arch/arm/vgic.c
> > +++ b/xen/arch/arm/vgic.c
> > @@ -84,10 +84,7 @@ int domain_vgic_init(struct domain *d, unsigned int 
> > nr_spis)
> >       d->arch.vgic.pending_irqs =
> >           xzalloc_array(struct pending_irq, d->arch.vgic.nr_spis);
> >       if ( d->arch.vgic.pending_irqs == NULL )
> > -    {
> > -        xfree(d->arch.vgic.shared_irqs);
> >           return -ENOMEM;
> > -    }
> >
> >       for (i=0; i<d->arch.vgic.nr_spis; i++)
> >       {
> >
> 



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel