x86/hvm: correct hvm_ioreq_server_alloc_rangesets() failure path
authorAndrew Cooper <andrew.cooper3@citrix.com>
Thu, 5 Jun 2014 15:43:26 +0000 (17:43 +0200)
committerJan Beulich <jbeulich@suse.com>
Thu, 5 Jun 2014 15:43:26 +0000 (17:43 +0200)
commita310f00882dfd4b07baedbab1e102cd4d0a4e867
tree1775557f77bb5c3f5cfc3a028d42d9720174ac05
parent203746bc36b41443d0eec78819f153fb59bc68d1
x86/hvm: correct hvm_ioreq_server_alloc_rangesets() failure path

Coverity-ID: 1220092 "Unsigned compare against 0"
Coverity-ID: 1220093 "Out-of-bounds read"

Both of these are cased by the the while() loop in the fail path, which
results in an infinite loop and memory corruption from rangeset_destroy().

Move hvm_ioreq_server_free_rangesets() up and use it for cleanup on the
failure path.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Paul Durrant <paul.durrant@citrix.com>
xen/arch/x86/hvm/hvm.c