[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH] xen/domctl: Fix double domid_free in XEN_DOMCTL_createdomain error path
- To: "xen-devel@xxxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- From: Oleksii Moisieiev <Oleksii_Moisieiev@xxxxxxxx>
- Date: Sat, 13 Sep 2025 10:44:39 +0000
- Accept-language: en-US
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epam.com; dmarc=pass action=none header.from=epam.com; dkim=pass header.d=epam.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=61uh5N/uThDNa1TWy+cKskqdhGcAZG1zA83c/tYm0iY=; b=OWCJdBHXwKxRAi537jC4ShmllQT58IbKeu7H0hEUIt4c+mEmhqVVsZc7QtB9lWEAee8bLoFkuHu6WlGeFzLxiDjKXybA/noYnagQ33ADcQquAq26D8ZT9cTVVgPmkHb1KKRraXrsEokaYsicpT9IdqzYyCPSX5xqd809Eid/Ml3bndyoYHNUYtJPvbr9GQ1nFvw9cbJHohKXt53yXy0kujkPc3Hqf27REyh4mCyJ7/EW6cBO+w3EEJ3UvOtmrKKpHOa9y7I0PU4d8bLncSAN3FPLjPT3WoQA5xIs4YKqu0qGTr8NTpVrh2UUtdlQJfrrmTwtzW9dCGor4AHF7t5oVw==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=JfEubHy5ELREPkhTtIxg5gN6rqVgeCcOOZveRD2jLAMhIpRcXNEOp0v1qstEjMewVQ6EySUpkvQluiEhPRDMZE2xUGNJ+Ow/RK8CB5zonhvoKjPqwBkhzTVcJk8/mGnJK3tY8vD0t1V//+a6M/EkpET1tEBALw8A0uuiOCjLDjNLgO2dLcciiCQsloxdoCDWavH9nG2bXFOzJLWPq1/PAHLGGIrCkztSgKyiVI+xO60ZKD06R30bRvmzH+odT7d8tRZzeruXX6f4asP/pMIA8ZIMK9n6HrrInu3SfGENUHuh5WApZEZXtPs86LB9BaPW9mPFNxfvmpw+k2tKIA4MRA==
- Authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=epam.com;
- Cc: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, Anthony PERARD <anthony.perard@xxxxxxxxxx>, Michal Orzel <michal.orzel@xxxxxxx>, Jan Beulich <jbeulich@xxxxxxxx>, Julien Grall <julien@xxxxxxx>, Roger Pau Monné <roger.pau@xxxxxxxxxx>, Stefano Stabellini <sstabellini@xxxxxxxxxx>, Oleksii Moisieiev <Oleksii_Moisieiev@xxxxxxxx>
- Delivery-date: Sat, 13 Sep 2025 10:44:51 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
- Thread-index: AQHcJJtnc9kfi+189ki0+czMQTtF+A==
- Thread-topic: [PATCH] xen/domctl: Fix double domid_free in XEN_DOMCTL_createdomain error path
Remove redundant domid_free() call in the XEN_DOMCTL_createdomain error
handling path to prevent a double-free condition.
When domain_create() fails, it internally calls _domain_destroy() during
its cleanup routine, which already invokes domid_free() to release the
allocated domain ID. The additional domid_free() call in the domctl error
path creates a double-free scenario, triggering an assertion failure in
domid.c:
Assertion 'rc' failed at common/domid.c:84
The domain creation flow is:
1. domid_alloc() allocates a domain ID
2. domain_create() is called with the allocated ID
3. If domain_create() fails:
a) domain_create() calls _domain_destroy() internally
b) _domain_destroy() calls domid_free() to release the ID
c) domctl incorrectly calls domid_free() again
This double-free violates the domain ID management invariants and causes
system instability. The fix ensures domid_free() is called exactly once
per allocated domain ID, maintaining proper resource cleanup
semantics.
Signed-off-by: Oleksii Moisieiev <oleksii_moisieiev@xxxxxxxx>
---
xen/common/domctl.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index 71e712c1f3..954d790226 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -421,7 +421,6 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t)
u_domctl)
d = domain_create(domid, &op->u.createdomain, false);
if ( IS_ERR(d) )
{
- domid_free(domid);
ret = PTR_ERR(d);
d = NULL;
break;
--
2.34.1
|
