Commit 06b35d00 authored Aug 26, 2013 by Dan Carpenter Committed by Konrad Rzeszutek Wilk Aug 30, 2013

xen/evtchn: double free on error



The call to del_evtchn() frees "evtchn".

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

parent a5deabe0

drivers/xen/evtchn.c

+0 −1

Original line number	Diff line number	Diff line
		@@ -319,7 +319,6 @@ err:
		if (HYPERVISOR_event_channel_op(EVTCHNOP_close, &close) != 0)
		BUG();
		del_evtchn(u, evtchn);
		kfree(evtchn);
		return rc;
		}