fix domain unlocking in some xsm error paths

A couple of xsm error/access-denied code paths in hypercalls neglect to
unlock a previously locked domain. Fix by ensuring the domains are
unlocked correctly.

Signed-off-by: Matthew Daley <mattjd@gmail.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>

diff --git a/xen/arch/x86/physdev.c b/xen/arch/x86/physdev.c
index 134eb732408c13027adfbe805459a904e0abbc25..e8b4e7684afcaa50556e67337360f738616f9b3c 100644 (file)
--- a/xen/arch/x86/physdev.c
+++ b/xen/arch/x86/physdev.c
@@ -111,7 +111,7 @@ int physdev_map_pirq(domid_t domid, int type, int *index, int *pirq_p,
 
     ret = xsm_map_domain_pirq(XSM_TARGET, d);
     if ( ret )
-        return ret;
+        goto free_domain;
 
     /* Verify or get irq. */
     switch ( type )

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 287714b231cd9d9a1dd64fc182ab1b846158df35..3f9732853a1f3ee826a17503e1f95a7b4f8a24c0 100644 (file)
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -2283,7 +2283,7 @@ gnttab_get_status_frames(XEN_GUEST_HANDLE_PARAM(gnttab_get_status_frames_t) uop,
     rc = xsm_grant_setup(XSM_TARGET, current->domain, d);
     if ( rc ) {
         op.status = GNTST_permission_denied;
-        goto out1;
+        goto out2;
     }
 
     gt = d->grant_table;