Commit 301cf2a8 authored Mar 06, 2019 by David Gibson Committed by Michael S. Tsirkin Mar 12, 2019

virtio-balloon: Don't mismatch g_malloc()/free (CID 1399146)



ed48c598 "virtio-balloon: Safely handle BALLOON_PAGE_SIZE < host
page size" introduced a new temporary data structure which tracks 4kiB
chunks which have been inserted into the balloon by the guest but
don't yet form a full host page which we can discard.

Unfortunately, I had a thinko and allocated that structure with
g_malloc0() but freed it with a plain free() rather than g_free().
This corrects the problem.

Fixes: ed48c598
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Message-Id: <20190306030601.21986-2-david@gibson.dropbear.id.au>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>

parent ae440bd1

hw/virtio/virtio-balloon.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -82,7 +82,7 @@ static void balloon_inflate_page(VirtIOBalloon *balloon,
		/* We've partially ballooned part of a host page, but now
		* we're trying to balloon part of a different one. Too hard,
		* give up on the old partial page */
		free(balloon->pbp);
		g_free(balloon->pbp);
		balloon->pbp = NULL;
		}

		@@ -107,7 +107,7 @@ static void balloon_inflate_page(VirtIOBalloon *balloon,
		* has already reported them, and failing to discard a balloon
		* page is not fatal */

		free(balloon->pbp);
		g_free(balloon->pbp);
		balloon->pbp = NULL;
		}
		}