From: Daniel Stodden <daniel.stodden@citrix.com>
Date: Wed, 13 Jul 2011 21:03:47 +0000 (-0700)
Subject: control: Fix devname use after free.
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=0f7cb92c845cd39085d60186072505fbd105cd89;p=people%2Fdstodden%2Fblktap.git

control: Fix devname use after free.

Rare error path only.

Signed-off-by: Daniel Stodden <daniel.stodden@citrix.com>
---

diff --git a/drivers/tapdisk-control.c b/drivers/tapdisk-control.c
index a669d04..bde77de 100644
--- a/drivers/tapdisk-control.c
+++ b/drivers/tapdisk-control.c
@@ -587,7 +587,7 @@ tapdisk_control_attach_vbd(struct tapdisk_ctl_conn *conn,
 			   tapdisk_message_t *request)
 {
 	tapdisk_message_t response;
-	char *devname;
+	char *devname = NULL;
 	td_vbd_t *vbd;
 	int minor, err;
 
@@ -615,12 +615,12 @@ tapdisk_control_attach_vbd(struct tapdisk_ctl_conn *conn,
 
 	err = asprintf(&devname, BLKTAP2_RING_DEVICE"%d", minor);
 	if (err == -1) {
+		devname = NULL;
 		err = -ENOMEM;
 		goto fail_vbd;
 	}
 
 	err = tapdisk_vbd_attach(vbd, devname, minor);
-	free(devname);
 	if (err) {
 		ERR(err, "failure attaching to %s", devname);
 		goto fail_vbd;
@@ -629,6 +629,9 @@ tapdisk_control_attach_vbd(struct tapdisk_ctl_conn *conn,
 	tapdisk_server_add_vbd(vbd);
 
 out:
+	if (devname)
+		free(devname);
+
 	memset(&response, 0, sizeof(response));
 	response.type = TAPDISK_MESSAGE_ATTACH_RSP;
 	response.cookie = request->cookie;