]> git.itanic.dy.fi Git - linux-stable/commit
xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()
authorDan Carpenter <dan.carpenter@linaro.org>
Wed, 3 May 2023 15:11:35 +0000 (18:11 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 30 May 2023 11:38:38 +0000 (12:38 +0100)
commitc84733a53fe01f9387d3a1ab42c1f3a7c0d56e93
treeadbe238a4ddbd0bc5edfd75e1f76fcf8889c5e44
parent00751a8a9b9f81ed819bef25984d1c5ed87171b8
xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()

commit 8fafac202d18230bb9926bda48e563fd2cce2a4f upstream.

In the pvcalls_new_active_socket() function, most error paths call
pvcalls_back_release_active(fedata->dev, fedata, map) which calls
sock_release() on "sock".  The bug is that the caller also frees sock.

Fix this by making every error path in pvcalls_new_active_socket()
release the sock, and don't free it in the caller.

Fixes: 5db4d286a8ef ("xen/pvcalls: implement connect command")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/e5f98dc2-0305-491f-a860-71bbd1398a2f@kili.mountain
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/xen/pvcalls-back.c