[Xen-devel] [PATCH] VT-d/RMRR: Avoid memory corruption in add_user_rmrr()

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

register_one_rmrr() already frees its parameter if errors are encountered.

Introduced by c/s 431685e8de and spotted by Coverity.

Coverity-ID: 1399607
Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
CC: Jan Beulich <JBeulich@xxxxxxxx>
---
 xen/drivers/passthrough/vtd/dmar.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/xen/drivers/passthrough/vtd/dmar.c 
b/xen/drivers/passthrough/vtd/dmar.c
index 4a6a819..1143a9d 100644
--- a/xen/drivers/passthrough/vtd/dmar.c
+++ b/xen/drivers/passthrough/vtd/dmar.c
@@ -975,13 +975,9 @@ static int __init add_user_rmrr(void)
         rmrr->scope.devices_cnt = user_rmrrs[i].dev_count;
 
         if ( register_one_rmrr(rmrr) )
-        {
             printk(XENLOG_ERR VTDPREFIX
                    "Could not register RMMR range "ERMRRU_FMT"\n",
                    ERMRRU_ARG(user_rmrrs[i]));
-            scope_devices_free(&rmrr->scope);
-            xfree(rmrr);
-        }
     }
 
     return 0;
-- 
2.1.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel