Commit a67baeb7 authored by David Vrabel's avatar David Vrabel Committed by Konrad Rzeszutek Wilk
Browse files

xen/gntdev: don't leak memory from IOCTL_GNTDEV_MAP_GRANT_REF 



map->kmap_ops allocated in gntdev_alloc_map() wasn't freed by
gntdev_put_map().

Add a gntdev_free_map() helper function to free everything allocated
by gntdev_alloc_map().

Signed-off-by: default avatarDavid Vrabel <david.vrabel@citrix.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
parent b6514633

drivers/xen/gntdev.c

+19 −17
Original line number Diff line number Diff line
@@ -105,6 +105,21 @@ static void gntdev_print_maps(struct gntdev_priv *priv, 
#endif

}



static void gntdev_free_map(struct grant_map *map)

{

	if (map == NULL)

		return;



	if (map->pages)

		free_xenballooned_pages(map->count, map->pages);

	kfree(map->pages);

	kfree(map->grants);

	kfree(map->map_ops);

	kfree(map->unmap_ops);

	kfree(map->kmap_ops);

	kfree(map);

}



static struct grant_map *gntdev_alloc_map(struct gntdev_priv *priv, int count)

{

	struct grant_map *add;
@@ -142,12 +157,7 @@ static struct grant_map *gntdev_alloc_map(struct gntdev_priv *priv, int count) 
	return add;



err:

	kfree(add->pages);

	kfree(add->grants);

	kfree(add->map_ops);

	kfree(add->unmap_ops);

	kfree(add->kmap_ops);

	kfree(add);

	gntdev_free_map(add);

	return NULL;

}
@@ -198,17 +208,9 @@ static void gntdev_put_map(struct grant_map *map) 
		evtchn_put(map->notify.event);

	}



	if (map->pages) {

		if (!use_ptemod)

	if (map->pages && !use_ptemod)

		unmap_grant_pages(map, 0, map->count);



		free_xenballooned_pages(map->count, map->pages);

	}

	kfree(map->pages);

	kfree(map->grants);

	kfree(map->map_ops);

	kfree(map->unmap_ops);

	kfree(map);

	gntdev_free_map(map);

}



/* ------------------------------------------------------------------ */

CRA Git | Maintained and supported by SUSTech CRA and CCSE