If set_px_pminfo is called a second time with a larger state_count than
the first call, calls to PMSTAT_get_pxstat will read beyond the end of
the pt and trans_pt buffers allocated in cpufreq_statistic_init() since
they would have been allocated with the original state_count.
Secondly, the states array leaks on each subsequent call of
set_px_pminfo.
Fix both these issues by ignoring subsequent calls to set_px_pminfo if
it completed successfully previously. Return success rather than an
error to avoid errors in the dom0 kernel log when reloading the
xen_acpi_processor module.
At the same time, fix a leak of the states array on error.
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
}
}
- if ( perf->flags & XEN_PX_PSS )
+ if ( perf->flags & XEN_PX_PSS && !pxpt->states )
{
/* capability check */
if ( perf->state_count <= 1 )
}
if ( copy_from_guest(pxpt->states, perf->states, perf->state_count) )
{
+ XFREE(pxpt->states);
ret = -EFAULT;
goto out;
}