mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-03 07:38:10 +00:00
xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()
commit8fafac202d
upstream. In the pvcalls_new_active_socket() function, most error paths call pvcalls_back_release_active(fedata->dev, fedata, map) which calls sock_release() on "sock". The bug is that the caller also frees sock. Fix this by making every error path in pvcalls_new_active_socket() release the sock, and don't free it in the caller. Fixes:5db4d286a8
("xen/pvcalls: implement connect command") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Juergen Gross <jgross@suse.com> Link: https://lore.kernel.org/r/e5f98dc2-0305-491f-a860-71bbd1398a2f@kili.mountain Signed-off-by: Juergen Gross <jgross@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
d0c80f48fb
commit
d33d0667c7
1 changed files with 4 additions and 5 deletions
|
@ -330,8 +330,10 @@ static struct sock_mapping *pvcalls_new_active_socket(
|
|||
void *page;
|
||||
|
||||
map = kzalloc(sizeof(*map), GFP_KERNEL);
|
||||
if (map == NULL)
|
||||
if (map == NULL) {
|
||||
sock_release(sock);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
map->fedata = fedata;
|
||||
map->sock = sock;
|
||||
|
@ -423,10 +425,8 @@ static int pvcalls_back_connect(struct xenbus_device *dev,
|
|||
req->u.connect.ref,
|
||||
req->u.connect.evtchn,
|
||||
sock);
|
||||
if (!map) {
|
||||
if (!map)
|
||||
ret = -EFAULT;
|
||||
sock_release(sock);
|
||||
}
|
||||
|
||||
out:
|
||||
rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
|
||||
|
@ -567,7 +567,6 @@ static void __pvcalls_back_accept(struct work_struct *work)
|
|||
sock);
|
||||
if (!map) {
|
||||
ret = -EFAULT;
|
||||
sock_release(sock);
|
||||
goto out_error;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue