diff options
| author | Manuel Andreas <manuel.andreas@tum.de> | 2025-07-23 17:51:20 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-07-24 08:56:38 +0200 |
| commit | fd627ac8a5cff4d45269f164b13ddddc0726f2cc (patch) | |
| tree | c3ad7deb952004a2ce724bc93d84a8c97389677c | |
| parent | ff7ccaadb0bf6b79a871e63ab6c50d3d68f83084 (diff) | |
KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls
commit 5a53249d149f48b558368c5338b9921b76a12f8c upstream.
kvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host
for more than one event channel potr (nr_ports > 1).
After the kmalloc_array(), the error paths need to go through the
"out" label, but the call to kvm_read_guest_virt() does not.
Fixes: 92c58965e965 ("KVM: x86/xen: Use kvm_read_guest_virt() instead of open-coding it badly")
Reviewed-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Manuel Andreas <manuel.andreas@tum.de>
[Adjusted commit message. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | arch/x86/kvm/xen.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c index 759cc3e9c0fa..1fc2035df404 100644 --- a/arch/x86/kvm/xen.c +++ b/arch/x86/kvm/xen.c @@ -1472,7 +1472,7 @@ static bool kvm_xen_schedop_poll(struct kvm_vcpu *vcpu, bool longmode, if (kvm_read_guest_virt(vcpu, (gva_t)sched_poll.ports, ports, sched_poll.nr_ports * sizeof(*ports), &e)) { *r = -EFAULT; - return true; + goto out; } for (i = 0; i < sched_poll.nr_ports; i++) { |