xen/pvcalls: Fix a check in pvcalls_front_remove()

Dan Carpenter · Boris Ostrovsky · commit 1ab134ca3151 · 2017-12-06T09:44:49.000-05:00
bedata->ref can't be less than zero because it's unsigned. This affects certain error paths in probe. We first set ->ref = -1 and then we set it to a valid value later. Fixes: 2196819 ("xen/pvcalls: connect to the backend") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Juergen Gross <jgross@suse.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
@@ -1103,7 +1103,7 @@ static int pvcalls_front_remove(struct xenbus_device *dev)
 			kfree(map);
 		}
 	}
-	if (bedata->ref >= 0)
+	if (bedata->ref != -1)
 		gnttab_end_foreign_access(bedata->ref, 0, 0);
 	kfree(bedata->ring.sring);
 	kfree(bedata);

Original file line number	Diff line number	Diff line change
`@@ -1103,7 +1103,7 @@ static int pvcalls_front_remove(struct xenbus_device *dev)`
`1103`	`1103`	`kfree(map);`
`1104`	`1104`	`}`
`1105`	`1105`	`}`
`1106`		`- if (bedata->ref >= 0)`
	`1106`	`+ if (bedata->ref != -1)`
`1107`	`1107`	`gnttab_end_foreign_access(bedata->ref, 0, 0);`
`1108`	`1108`	`kfree(bedata->ring.sring);`
`1109`	`1109`	`kfree(bedata);`