[XenPPC] [linux-ppc-2.6] Fix potential xencomm memory leaks in the kernel's hypercall translation paths.

["Xen patchbot-linux-ppc-2.6" <patchbot-linux-ppc-2.6@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Hollis Blanchard <hollisb@xxxxxxxxxx>
# Date 1172766459 21600
# Node ID 3e512eaf2a6f0f740331bc891fbc0a29392a2794
# Parent  1abaceb1e6e8858b3929d5d6fd20fc3192f47e33
Fix potential xencomm memory leaks in the kernel's hypercall translation paths.
Signed-off-by: Jerone Young <jyoung5@xxxxxxxxxx>
Signed-off-by: Hollis Blanchard <hollisb@xxxxxxxxxx>
---
 arch/powerpc/platforms/xen/hcall.c |   28 +++++++++++++++-------------
 1 files changed, 15 insertions(+), 13 deletions(-)

diff -r 1abaceb1e6e8 -r 3e512eaf2a6f arch/powerpc/platforms/xen/hcall.c
--- a/arch/powerpc/platforms/xen/hcall.c        Thu Mar 01 10:11:53 2007 -0600
+++ b/arch/powerpc/platforms/xen/hcall.c        Thu Mar 01 10:27:39 2007 -0600
@@ -160,7 +160,7 @@ int HYPERVISOR_sched_op(int cmd, void *a
 int HYPERVISOR_sched_op(int cmd, void *arg)
 {
        int argsize = 0;
-       int rc;
+       int rc = -EINVAL;
        void *desc;
        evtchn_port_t *ports = NULL;
 
@@ -202,12 +202,11 @@ int HYPERVISOR_sched_op(int cmd, void *a
        }
 
        desc = xencomm_map_no_alloc(arg, argsize); 
-
-       if (desc == NULL)
-               return -EINVAL;
-
-       rc = plpar_hcall_norets(XEN_MARK(__HYPERVISOR_sched_op),
-                               cmd, desc);
+       if (desc) {
+               rc = plpar_hcall_norets(XEN_MARK(__HYPERVISOR_sched_op),
+                                       cmd, desc);
+               xencomm_free(desc);
+       }
 
        xencomm_free(ports);
 
@@ -389,8 +388,8 @@ static int xenppc_privcmd_domctl(privcmd
        if (copy_to_user(user_op, &kern_op, sizeof(xen_domctl_t)))
                ret = -EFAULT;
 
-       xencomm_free(desc);
 out:
+       xencomm_free(desc);
        xencomm_free(op_desc);
        return ret;
 }
@@ -463,8 +462,8 @@ static int xenppc_privcmd_sysctl(privcmd
        if (copy_to_user(user_op, &kern_op, sizeof(xen_sysctl_t)))
                ret = -EFAULT;
 
-       xencomm_free(desc);
 out:
+       xencomm_free(desc);
        xencomm_free(op_desc);
        return ret;
 }
@@ -514,8 +513,8 @@ static int xenppc_privcmd_platform_op(pr
        if (copy_to_user(user_op, &kern_op, sizeof(xen_platform_op_t)))
                ret = -EFAULT;
 
-       xencomm_free(desc);
 out:
+       xencomm_free(desc);
        xencomm_free(op_desc);
        return ret;
 }
@@ -546,8 +545,10 @@ int HYPERVISOR_memory_op(unsigned int cm
                                mop->nr_extents *
                                sizeof(*xen_guest_handle(mop->extent_start)));
 
-                       if (desc == NULL)
-                               return -ENOMEM;
+                       if (desc == NULL) {
+                               ret = -ENOMEM;
+                               goto out;
+                       }
 
                        set_xen_guest_handle(mop->extent_start,
                                             desc);
@@ -569,9 +570,10 @@ int HYPERVISOR_memory_op(unsigned int cm
                printk(KERN_ERR "%s: unknown memory op %d\n", __func__, cmd);
                ret = -ENOSYS;
        }
+
+out:
        xencomm_free(op_desc);
        return ret;
-
 }
 EXPORT_SYMBOL(HYPERVISOR_memory_op);
 

_______________________________________________
Xen-ppc-devel mailing list
Xen-ppc-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-ppc-devel