diff options
| author | ngie <ngie@FreeBSD.org> | 2016-06-10 14:45:20 +0000 |
|---|---|---|
| committer | ngie <ngie@FreeBSD.org> | 2016-06-10 14:45:20 +0000 |
| commit | f17a072a07c9241f9501289da18753df26f4abdc (patch) | |
| tree | d6f26f14c887ee9e70f5e7e4762c66d69d75be07 /sys/kern/subr_vmem.c | |
| parent | 83bbb03153bf972ad0e7905fe2e746b223a47c34 (diff) | |
| download | FreeBSD-src-f17a072a07c9241f9501289da18753df26f4abdc.zip FreeBSD-src-f17a072a07c9241f9501289da18753df26f4abdc.tar.gz | |
MFC r299494:
r299494 (by cem):
subr_vmem: Fix double-free in error case of vmem_create
If vmem_init() fails, 'vm' is already destroyed and freed. Don't free it
again.
CID: 1042110
Diffstat (limited to 'sys/kern/subr_vmem.c')
| -rw-r--r-- | sys/kern/subr_vmem.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/sys/kern/subr_vmem.c b/sys/kern/subr_vmem.c index 80940be..2ec45c3 100644 --- a/sys/kern/subr_vmem.c +++ b/sys/kern/subr_vmem.c @@ -1046,10 +1046,8 @@ vmem_create(const char *name, vmem_addr_t base, vmem_size_t size, if (vm == NULL) return (NULL); if (vmem_init(vm, name, base, size, quantum, qcache_max, - flags) == NULL) { - free(vm, M_VMEM); + flags) == NULL) return (NULL); - } return (vm); } |
