Re: [PATCH] xen/front-pgdir-shbuf: free grant reference head on errors

[Stefano Stabellini <sstabellini@xxxxxxxxxx>]

On Mon, 29 Jun 2026, Yousef Alhouseen wrote:
> grant_references() allocates a private grant-reference head before
> claiming references for the page directory and, for guest-owned buffers,
> the data pages. The success path frees the remaining head, but claim
> failures and grant_refs_for_buffer() errors return immediately.
> 
> Unwind through a common exit path so the private grant-reference head is
> released even when granting fails part-way through setup. The caller
> still tears down any references already stored in buf->grefs.
> 
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@xxxxxxxxx>

Reviewed-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>


> ---
>  drivers/xen/xen-front-pgdir-shbuf.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/xen/xen-front-pgdir-shbuf.c 
> b/drivers/xen/xen-front-pgdir-shbuf.c
> index 9c7d8af6e6a1..428187edf85d 100644
> --- a/drivers/xen/xen-front-pgdir-shbuf.c
> +++ b/drivers/xen/xen-front-pgdir-shbuf.c
> @@ -445,8 +445,10 @@ static int grant_references(struct xen_front_pgdir_shbuf 
> *buf)
>               unsigned long frame;
>  
>               cur_ref = gnttab_claim_grant_reference(&priv_gref_head);
> -             if (cur_ref < 0)
> -                     return cur_ref;
> +             if (cur_ref < 0) {
> +                     ret = cur_ref;
> +                     goto out_free_refs;
> +             }
>  
>               frame = xen_page_to_gfn(virt_to_page(buf->directory +
>                                                    PAGE_SIZE * i));
> @@ -457,11 +459,13 @@ static int grant_references(struct 
> xen_front_pgdir_shbuf *buf)
>       if (buf->ops->grant_refs_for_buffer) {
>               ret = buf->ops->grant_refs_for_buffer(buf, &priv_gref_head, j);
>               if (ret)
> -                     return ret;
> +                     goto out_free_refs;
>       }
>  
> +     ret = 0;
> +out_free_refs:
>       gnttab_free_grant_references(priv_gref_head);
> -     return 0;
> +     return ret;
>  }
>  
>  /*
> -- 
> 2.54.0
>