[Xen-changelog] [xen master] VT-d/RMRR: Avoid memory corruption in add_user_rmrr()

[patchbot@xxxxxxx]

commit 7a4cf23e2653e8abf4793820487df32b094de56a
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Mon Jan 30 10:09:06 2017 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Mon Jan 30 11:07:48 2017 +0000

    VT-d/RMRR: Avoid memory corruption in add_user_rmrr()
    
    register_one_rmrr() already frees its parameter if errors are encountered.
    
    Introduced by c/s 431685e8de and spotted by Coverity.
    
    Coverity-ID: 1399607
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/drivers/passthrough/vtd/dmar.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/xen/drivers/passthrough/vtd/dmar.c 
b/xen/drivers/passthrough/vtd/dmar.c
index 4a6a819..1143a9d 100644
--- a/xen/drivers/passthrough/vtd/dmar.c
+++ b/xen/drivers/passthrough/vtd/dmar.c
@@ -975,13 +975,9 @@ static int __init add_user_rmrr(void)
         rmrr->scope.devices_cnt = user_rmrrs[i].dev_count;
 
         if ( register_one_rmrr(rmrr) )
-        {
             printk(XENLOG_ERR VTDPREFIX
                    "Could not register RMMR range "ERMRRU_FMT"\n",
                    ERMRRU_ARG(user_rmrrs[i]));
-            scope_devices_free(&rmrr->scope);
-            xfree(rmrr);
-        }
     }
 
     return 0;
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog