[Xen-devel] bug in xenbus_dev.c?

["James Harper" <james.harper@xxxxxxxxxxxxxxxx>]

I'm implementing a userspace channel in the GPLPV drivers so that the
xenstore tools (once ported) can work, and I noticed this code in the
xenbus_dev_write() function in xenbus_dev.c:

"
        case XS_SET_PERMS:
                if (msg_type == XS_TRANSACTION_START) {
-->A                    trans = kmalloc(sizeof(*trans), GFP_KERNEL);
                        if (!trans) {
                                rc = -ENOMEM;
                                goto out;
                        }
                }

                reply = xenbus_dev_request_and_reply(&u->u.msg);
                if (IS_ERR(reply)) {
-->B                    kfree(trans);
                        rc = PTR_ERR(reply);
                        goto out;
                }
"

The code at A is only executed if 'msg_type == XS_TRANSACTION_START',
but isn't it possible for B to be executed in the
non-XS_TRANSACTION_START code path, resulting in kfree(NULL)?

James


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel