Skip to content

Commit

Permalink
xen-pciback: fix up cleanup path when alloc fails
Browse files Browse the repository at this point in the history
When allocating a pciback device fails, clear the private
field. This could lead to an use-after free, however
the 'really_probe' takes care of setting
dev_set_drvdata(dev, NULL) in its failure path (which we would
exercise if the ->probe function failed), so we we
are OK. However lets be defensive as the code can change.

Going forward we should clean up the pci_set_drvdata(dev, NULL)
in the various code-base. That will be for another day.

Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Reported-by: Jonathan Creekmore <jonathan.creekmore@gmail.com>
Signed-off-by: Doug Goldstein <cardoe@cardoe.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
  • Loading branch information
Doug Goldstein authored and Konrad Rzeszutek Wilk committed Dec 18, 2015
1 parent 408fb0e commit 584a561
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion drivers/xen/xen-pciback/xenbus.c
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,6 @@ static struct xen_pcibk_device *alloc_pdev(struct xenbus_device *xdev)
dev_dbg(&xdev->dev, "allocated pdev @ 0x%p\n", pdev);

pdev->xdev = xdev;
dev_set_drvdata(&xdev->dev, pdev);

mutex_init(&pdev->dev_lock);

Expand All @@ -58,6 +57,9 @@ static struct xen_pcibk_device *alloc_pdev(struct xenbus_device *xdev)
kfree(pdev);
pdev = NULL;
}

dev_set_drvdata(&xdev->dev, pdev);

out:
return pdev;
}
Expand Down

0 comments on commit 584a561

Please sign in to comment.