diff options
| author | Jennifer Herbert <Jennifer.Herbert@citrix.com> | 2015-02-05 17:45:40 +0300 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@verizon.com> | 2016-07-20 18:35:52 +0300 |
| commit | 12d75ae734c265f419cf063e750d476a6a2d99ff (patch) | |
| tree | 557bfb68090931ede090ae01d1f36e112f8e9bed /drivers/xen | |
| parent | aad82778ead7e9fa63b07a420eb1d5bab7dcbb0e (diff) | |
| download | linux-12d75ae734c265f419cf063e750d476a6a2d99ff.tar.xz | |
xenbus: Add proper handling of XS_ERROR from Xenbus for transactions.
[ Upstream commit a2e75bc2ee207351e6806e77a5379c6c1dd4598a ]
If Xenstore sends back a XS_ERROR for TRANSACTION_END, the driver BUGs
because it cannot find the matching transaction in the list. For
TRANSACTION_START, it leaks memory.
Check the message as returned from xenbus_dev_request_and_reply(), and
clean up for TRANSACTION_START or discard the error for
TRANSACTION_END.
Signed-off-by: Jennifer Herbert <Jennifer.Herbert@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Diffstat (limited to 'drivers/xen')
| -rw-r--r-- | drivers/xen/xenbus/xenbus_dev_frontend.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c index 85534ea63555..9433e46518c8 100644 --- a/drivers/xen/xenbus/xenbus_dev_frontend.c +++ b/drivers/xen/xenbus/xenbus_dev_frontend.c @@ -326,10 +326,13 @@ static int xenbus_write_transaction(unsigned msg_type, } if (msg_type == XS_TRANSACTION_START) { - trans->handle.id = simple_strtoul(reply, NULL, 0); - - list_add(&trans->list, &u->transactions); - } else if (msg_type == XS_TRANSACTION_END) { + if (u->u.msg.type == XS_ERROR) + kfree(trans); + else { + trans->handle.id = simple_strtoul(reply, NULL, 0); + list_add(&trans->list, &u->transactions); + } + } else if (u->u.msg.type == XS_TRANSACTION_END) { list_for_each_entry(trans, &u->transactions, list) if (trans->handle.id == u->u.msg.tx_id) break; |