diff options
author | ngie <ngie@FreeBSD.org> | 2016-06-10 14:45:20 +0000 |
---|---|---|
committer | ngie <ngie@FreeBSD.org> | 2016-06-10 14:45:20 +0000 |
commit | f17a072a07c9241f9501289da18753df26f4abdc (patch) | |
tree | d6f26f14c887ee9e70f5e7e4762c66d69d75be07 /sys | |
parent | 83bbb03153bf972ad0e7905fe2e746b223a47c34 (diff) | |
download | FreeBSD-src-f17a072a07c9241f9501289da18753df26f4abdc.zip FreeBSD-src-f17a072a07c9241f9501289da18753df26f4abdc.tar.gz |
MFC r299494:
r299494 (by cem):
subr_vmem: Fix double-free in error case of vmem_create
If vmem_init() fails, 'vm' is already destroyed and freed. Don't free it
again.
CID: 1042110
Diffstat (limited to 'sys')
-rw-r--r-- | sys/kern/subr_vmem.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/sys/kern/subr_vmem.c b/sys/kern/subr_vmem.c index 80940be..2ec45c3 100644 --- a/sys/kern/subr_vmem.c +++ b/sys/kern/subr_vmem.c @@ -1046,10 +1046,8 @@ vmem_create(const char *name, vmem_addr_t base, vmem_size_t size, if (vm == NULL) return (NULL); if (vmem_init(vm, name, base, size, quantum, qcache_max, - flags) == NULL) { - free(vm, M_VMEM); + flags) == NULL) return (NULL); - } return (vm); } |