diff options
| author | Keir Fraser <keir.fraser@citrix.com> | 2009-11-23 06:48:14 +0000 |
|---|---|---|
| committer | Keir Fraser <keir.fraser@citrix.com> | 2009-11-23 06:48:14 +0000 |
| commit | 463016ab582fb68a17e2f18bcf29a7254a910b73 (patch) | |
| tree | 45d75d8f8148cea4d904fa038b62b928659096cf /xen/common/tmem_xen.c | |
| parent | f38a18594b0daa754f99f802093f0c80a6635634 (diff) | |
| download | xen-463016ab582fb68a17e2f18bcf29a7254a910b73.tar.gz xen-463016ab582fb68a17e2f18bcf29a7254a910b73.tar.bz2 xen-463016ab582fb68a17e2f18bcf29a7254a910b73.zip | |
tmem: fix double-free bug
Tmem double-frees a high-level data structure causing memory
corruption under certain circumstances.
Signed-off-by: Dan Magenheimer <dan.magenheimer@oracle.com>
Diffstat (limited to 'xen/common/tmem_xen.c')
| -rw-r--r-- | xen/common/tmem_xen.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/xen/common/tmem_xen.c b/xen/common/tmem_xen.c index 26f593417e..12e67f3464 100644 --- a/xen/common/tmem_xen.c +++ b/xen/common/tmem_xen.c @@ -295,7 +295,7 @@ EXPORT tmh_client_t *tmh_client_init(void) if ( (tmh = xmalloc(tmh_client_t)) == NULL ) return NULL; for (i = 0, shift = 12; i < 4; shift -=4, i++) - name[i] = ((unsigned short)domid >> shift) & 0xf; + name[i] = (((unsigned short)domid >> shift) & 0xf) + '0'; name[4] = '\0'; #ifndef __i386__ tmh->persistent_pool = xmem_pool_create(name, tmh_persistent_pool_page_get, @@ -316,7 +316,6 @@ EXPORT void tmh_client_destroy(tmh_client_t *tmh) xmem_pool_destroy(tmh->persistent_pool); #endif put_domain(tmh->domain); - xfree(tmh); } /****************** XEN-SPECIFIC HOST INITIALIZATION ********************/ |