diff options
| author | David Gibson <david@gibson.dropbear.id.au> | 2019-03-06 14:05:59 +1100 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2019-07-30 12:34:38 -0500 |
| commit | 80c96a7b604d5f3816d857d4d108518895c1db2b (patch) | |
| tree | ba58889952d602c3c927aecef75c1f336f28aec3 | |
| parent | 118112024d75559103b7d8c3b7c020da894f15c5 (diff) | |
virtio-balloon: Don't mismatch g_malloc()/free (CID 1399146)
ed48c59875b6 "virtio-balloon: Safely handle BALLOON_PAGE_SIZE < host
page size" introduced a new temporary data structure which tracks 4kiB
chunks which have been inserted into the balloon by the guest but
don't yet form a full host page which we can discard.
Unfortunately, I had a thinko and allocated that structure with
g_malloc0() but freed it with a plain free() rather than g_free().
This corrects the problem.
Fixes: ed48c59875b6
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20190306030601.21986-2-david@gibson.dropbear.id.au>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
(cherry picked from commit 301cf2a8dd5024aa5bbdc6bd3e121174bbfc2957)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
| -rw-r--r-- | hw/virtio/virtio-balloon.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c index d3f2913a85..127289ae0e 100644 --- a/hw/virtio/virtio-balloon.c +++ b/hw/virtio/virtio-balloon.c @@ -81,7 +81,7 @@ static void balloon_inflate_page(VirtIOBalloon *balloon, /* We've partially ballooned part of a host page, but now * we're trying to balloon part of a different one. Too hard, * give up on the old partial page */ - free(balloon->pbp); + g_free(balloon->pbp); balloon->pbp = NULL; } @@ -106,7 +106,7 @@ static void balloon_inflate_page(VirtIOBalloon *balloon, * has already reported them, and failing to discard a balloon * page is not fatal */ - free(balloon->pbp); + g_free(balloon->pbp); balloon->pbp = NULL; } } |