[xen stable-4.21] xen/ioreq: drop the emulator reference when range set allocation fails

[patchbot@xxxxxxx]

commit ed1f8d8deea6801810145fbe015581d109d67a31
Author:     Edgar E. Iglesias <edgar.iglesias@xxxxxxx>
AuthorDate: Thu Oct 29 13:22:27 2026 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Oct 29 13:22:27 2026 +0100

    xen/ioreq: drop the emulator reference when range set allocation fails
    
    ioreq_server_init() takes a reference on the emulating domain before
    allocating the server's range sets, but does not release it when that
    allocation fails. The leaked reference prevents the emulating domain
    from ever being fully destroyed.
    
    Route this failure through the existing put_domain() cleanup.
    
    Fixes: ccb42e0ca661 ("x86/hvm: take a reference on ioreq server emulating 
domain")
    Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xxxxxxx>
    Reviewed-by: Mykola Kvach <mykola_kvach@xxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: 383aa8f617fba683749450d4f716a1384e58a253
    master date: 2026-10-01 09:59:28 +0200
---
 xen/common/ioreq.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/xen/common/ioreq.c b/xen/common/ioreq.c
index f5fd30ce12..4b321a5c61 100644
--- a/xen/common/ioreq.c
+++ b/xen/common/ioreq.c
@@ -595,7 +595,7 @@ static int ioreq_server_init(struct ioreq_server *s,
 
     rc = ioreq_server_alloc_rangesets(s, id);
     if ( rc )
-        return rc;
+        goto fail_rangesets;
 
     s->bufioreq_handling = bufioreq_handling;
 
@@ -614,6 +614,7 @@ static int ioreq_server_init(struct ioreq_server *s,
 
     ioreq_server_free_rangesets(s);
 
+ fail_rangesets:
     put_domain(s->emulator);
     return rc;
 }
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.21