From: Andrew Cooper <andrew.cooper3@citrix.com>
Date: Mon, 30 Jan 2017 10:09:06 +0000 (+0000)
Subject: VT-d/RMRR: Avoid memory corruption in add_user_rmrr()
X-Git-Tag: archive/raspbian/4.11.1-1+rpi1~1^2~66^2~2880
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/success//%22http:/www.example.com/cgi/success/?a=commitdiff_plain;h=7a4cf23e2653e8abf4793820487df32b094de56a;p=xen.git

VT-d/RMRR: Avoid memory corruption in add_user_rmrr()

register_one_rmrr() already frees its parameter if errors are encountered.

Introduced by c/s 431685e8de and spotted by Coverity.

Coverity-ID: 1399607
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
---

diff --git a/xen/drivers/passthrough/vtd/dmar.c b/xen/drivers/passthrough/vtd/dmar.c
index 4a6a819dbd..1143a9dee5 100644
--- a/xen/drivers/passthrough/vtd/dmar.c
+++ b/xen/drivers/passthrough/vtd/dmar.c
@@ -975,13 +975,9 @@ static int __init add_user_rmrr(void)
         rmrr->scope.devices_cnt = user_rmrrs[i].dev_count;
 
         if ( register_one_rmrr(rmrr) )
-        {
             printk(XENLOG_ERR VTDPREFIX
                    "Could not register RMMR range "ERMRRU_FMT"\n",
                    ERMRRU_ARG(user_rmrrs[i]));
-            scope_devices_free(&rmrr->scope);
-            xfree(rmrr);
-        }
     }
 
     return 0;