On Mon, Apr 12, 2021 at 3:21 PM Sean Christopherson <[email protected]> wrote: > > Abort the walk of coalesced MMIO zones if kvm_io_bus_unregister_dev() > fails to allocate memory for the new instance of the bus. If it can't > instantiate a new bus, unregister_dev() destroys all devices _except_ the > target device. But, it doesn't tell the caller that it obliterated the > bus and invoked the destructor for all devices that were on the bus. In > the coalesced MMIO case, this can result in a deleted list entry > dereference due to attempting to continue iterating on coalesced_zones > after future entries (in the walk) have been deleted. > > Opportunistically add curly braces to the for-loop, which encompasses > many lines but sneaks by without braces due to the guts being a single > if statement. > > Fixes: f65886606c2d ("KVM: fix memory leak in kvm_io_bus_unregister_dev()") > Cc: [email protected] > Reported-by: Hao Sun <[email protected]> > Signed-off-by: Sean Christopherson <[email protected]> Reviewed-by: Jim Mattson <[email protected]>
