From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 5 Dec 2017 14:38:54 +0000 (+0300)
Subject: xen/pvcalls: Fix a check in pvcalls_front_remove()
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=1ab134ca3151c55b6fc606857e71d9adb4c355d1;p=openwrt%2Fstaging%2Fblogic.git

xen/pvcalls: Fix a check in pvcalls_front_remove()

bedata->ref can't be less than zero because it's unsigned.  This affects
certain error paths in probe.  We first set ->ref = -1 and then we set
it to a valid value later.

Fixes: 219681909913 ("xen/pvcalls: connect to the backend")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
---

diff --git a/drivers/xen/pvcalls-front.c b/drivers/xen/pvcalls-front.c
index afa3f1b5d807..d1e1d8d2b9d5 100644
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@ -1103,7 +1103,7 @@ static int pvcalls_front_remove(struct xenbus_device *dev)
 			kfree(map);
 		}
 	}
-	if (bedata->ref >= 0)
+	if (bedata->ref != -1)
 		gnttab_end_foreign_access(bedata->ref, 0, 0);
 	kfree(bedata->ring.sring);
 	kfree(bedata);