[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH] xen/xenbus: Fix a double free in xenbus_map_ring_pv()

To: Dan Carpenter <dan.carpenter@xxxxxxxxxx>, Boris Ostrovsky <boris.ostrovsky@xxxxxxxxxx>
From: Jürgen Groß <jgross@xxxxxxxx>
Date: Fri, 10 Jul 2020 14:15:33 +0200
Cc: Yan Yankovskyi <yyankovskyi@xxxxxxxxx>, Stefano Stabellini <sstabellini@xxxxxxxxxx>, kernel-janitors@xxxxxxxxxxxxxxx, Wei Liu <wl@xxxxxxx>, xen-devel@xxxxxxxxxxxxxxxxxxxx
Delivery-date: Fri, 10 Jul 2020 12:15:39 +0000
List-id: Xen developer discussion <xen-devel.lists.xenproject.org>

On 10.07.20 13:36, Dan Carpenter wrote:

When there is an error the caller frees "info->node" so the free here
will result in a double free.  We should just delete first kfree().

Fixes: 3848e4e0a32a ("xen/xenbus: avoid large structs and arrays on the stack")
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>


Thanks for spotting this!

Reviewed-by: Juergen Gross <jgross@xxxxxxxx>


Juergen

Follow-Ups:
- Re: [PATCH] xen/xenbus: Fix a double free in xenbus_map_ring_pv()
  - From: Boris Ostrovsky

References:
- [PATCH] xen/xenbus: Fix a double free in xenbus_map_ring_pv()
  - From: Dan Carpenter

Prev by Date: Re: Followup of yesterday's design session "refactoring the REST"
Next by Date: [xen-unstable test] 151774: tolerable FAIL
Previous by thread: [PATCH] xen/xenbus: Fix a double free in xenbus_map_ring_pv()
Next by thread: Re: [PATCH] xen/xenbus: Fix a double free in xenbus_map_ring_pv()
Index(es):
- Date
- Thread

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.