aboutsummaryrefslogtreecommitdiff
path: root/hw/virtio/virtio-balloon.c
diff options
context:
space:
mode:
authorDavid Gibson <david@gibson.dropbear.id.au>2019-03-06 14:05:59 +1100
committerMichael S. Tsirkin <mst@redhat.com>2019-03-12 21:22:31 -0400
commit301cf2a8dd5024aa5bbdc6bd3e121174bbfc2957 (patch)
tree523061c89b0a9f8ec7f252583f789ac9690984a6 /hw/virtio/virtio-balloon.c
parentae440bd14c002f3a5528bd38e8a285ea625c04ca (diff)
virtio-balloon: Don't mismatch g_malloc()/free (CID 1399146)
ed48c59875b6 "virtio-balloon: Safely handle BALLOON_PAGE_SIZE < host page size" introduced a new temporary data structure which tracks 4kiB chunks which have been inserted into the balloon by the guest but don't yet form a full host page which we can discard. Unfortunately, I had a thinko and allocated that structure with g_malloc0() but freed it with a plain free() rather than g_free(). This corrects the problem. Fixes: ed48c59875b6 Reported-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20190306030601.21986-2-david@gibson.dropbear.id.au> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: David Hildenbrand <david@redhat.com>
Diffstat (limited to 'hw/virtio/virtio-balloon.c')
-rw-r--r--hw/virtio/virtio-balloon.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index b614552352..1859724a36 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -82,7 +82,7 @@ static void balloon_inflate_page(VirtIOBalloon *balloon,
/* We've partially ballooned part of a host page, but now
* we're trying to balloon part of a different one. Too hard,
* give up on the old partial page */
- free(balloon->pbp);
+ g_free(balloon->pbp);
balloon->pbp = NULL;
}
@@ -107,7 +107,7 @@ static void balloon_inflate_page(VirtIOBalloon *balloon,
* has already reported them, and failing to discard a balloon
* page is not fatal */
- free(balloon->pbp);
+ g_free(balloon->pbp);
balloon->pbp = NULL;
}
}