Commit 5a53249d authored by Manuel Andreas's avatar Manuel Andreas Committed by Paolo Bonzini
Browse files

KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls 



kvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host
for more than one event channel potr (nr_ports > 1).

After the kmalloc_array(), the error paths need to go through the
"out" label, but the call to kvm_read_guest_virt() does not.

Fixes: 92c58965 ("KVM: x86/xen: Use kvm_read_guest_virt() instead of open-coding it badly")
Reviewed-by: default avatarDavid Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: default avatarManuel Andreas <manuel.andreas@tum.de>
[Adjusted commit message. - Paolo]
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 4b7d440d

arch/x86/kvm/xen.c

+1 −1
Original line number Diff line number Diff line
@@ -1526,7 +1526,7 @@ static bool kvm_xen_schedop_poll(struct kvm_vcpu *vcpu, bool longmode, 
	if (kvm_read_guest_virt(vcpu, (gva_t)sched_poll.ports, ports,

				sched_poll.nr_ports * sizeof(*ports), &e)) {

		*r = -EFAULT;

		return true;

		goto out;

	}



	for (i = 0; i < sched_poll.nr_ports; i++) {