Xen devel - Dec 2008 - bug in xenbus_dev.c?

I''m implementing a userspace channel in the GPLPV drivers so that the
xenstore tools (once ported) can work, and I noticed this code in the
xenbus_dev_write() function in xenbus_dev.c:

"
        case XS_SET_PERMS:
                if (msg_type == XS_TRANSACTION_START) {
-->A                    trans = kmalloc(sizeof(*trans), GFP_KERNEL);
                        if (!trans) {
                                rc = -ENOMEM;
                                goto out;
                        }
                }

                reply = xenbus_dev_request_and_reply(&u->u.msg);
                if (IS_ERR(reply)) {
-->B                    kfree(trans);
                        rc = PTR_ERR(reply);
                        goto out;
                }
"

The code at A is only executed if ''msg_type ==
XS_TRANSACTION_START'',
but isn''t it possible for B to be executed in the
non-XS_TRANSACTION_START code path, resulting in kfree(NULL)?

James


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

On 21/12/2008 03:32, "James Harper"
<james.harper@bendigoit.com.au> wrote:
> The code at A is only executed if ''msg_type ==
XS_TRANSACTION_START'',
> but isn''t it possible for B to be executed in the
> non-XS_TRANSACTION_START code path, resulting in kfree(NULL)?
kfree(NULL) is valid and a no-op.

 -- Keir



_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel