Commit d33d0667 authored May 03, 2023 by Dan Carpenter Committed by Greg Kroah-Hartman May 30, 2023

xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()



commit 8fafac202d18230bb9926bda48e563fd2cce2a4f upstream.

In the pvcalls_new_active_socket() function, most error paths call
pvcalls_back_release_active(fedata->dev, fedata, map) which calls
sock_release() on "sock".  The bug is that the caller also frees sock.

Fix this by making every error path in pvcalls_new_active_socket()
release the sock, and don't free it in the caller.

Fixes: 5db4d286 ("xen/pvcalls: implement connect command")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/e5f98dc2-0305-491f-a860-71bbd1398a2f@kili.mountain


Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent d0c80f48

drivers/xen/pvcalls-back.c

+4 −5

Original line number	Diff line number	Diff line
		@@ -330,8 +330,10 @@ static struct sock_mapping *pvcalls_new_active_socket(
		void *page;

		map = kzalloc(sizeof(*map), GFP_KERNEL);
		if (map == NULL)
		if (map == NULL) {
		sock_release(sock);
		return NULL;
		}

		map->fedata = fedata;
		map->sock = sock;
		@@ -423,10 +425,8 @@ static int pvcalls_back_connect(struct xenbus_device *dev,
		req->u.connect.ref,
		req->u.connect.evtchn,
		sock);
		if (!map) {
		if (!map)
		ret = -EFAULT;
		sock_release(sock);
		}

		out:
		rsp = RING_GET_RESPONSE(&fedata->ring, fedata->ring.rsp_prod_pvt++);
		@@ -567,7 +567,6 @@ static void __pvcalls_back_accept(struct work_struct *work)
		sock);
		if (!map) {
		ret = -EFAULT;
		sock_release(sock);
		goto out_error;
		}