diff options
| author | David Gibson | 2019-03-06 04:05:59 +0100 |
|---|---|---|
| committer | Michael S. Tsirkin | 2019-03-13 02:22:31 +0100 |
| commit | 301cf2a8dd5024aa5bbdc6bd3e121174bbfc2957 (patch) | |
| tree | 523061c89b0a9f8ec7f252583f789ac9690984a6 /scripts/modules | |
| parent | virtio-balloon: fix a use-after-free case (diff) | |
| download | qemu-301cf2a8dd5024aa5bbdc6bd3e121174bbfc2957.tar.gz qemu-301cf2a8dd5024aa5bbdc6bd3e121174bbfc2957.tar.xz qemu-301cf2a8dd5024aa5bbdc6bd3e121174bbfc2957.zip | |
virtio-balloon: Don't mismatch g_malloc()/free (CID 1399146)
ed48c59875b6 "virtio-balloon: Safely handle BALLOON_PAGE_SIZE < host
page size" introduced a new temporary data structure which tracks 4kiB
chunks which have been inserted into the balloon by the guest but
don't yet form a full host page which we can discard.
Unfortunately, I had a thinko and allocated that structure with
g_malloc0() but freed it with a plain free() rather than g_free().
This corrects the problem.
Fixes: ed48c59875b6
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20190306030601.21986-2-david@gibson.dropbear.id.au>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Diffstat (limited to 'scripts/modules')
0 files changed, 0 insertions, 0 deletions