diff options
| author | anton <anton@cvs.openbsd.org> | 2019-09-10 19:36:13 +0000 |
|---|---|---|
| committer | anton <anton@cvs.openbsd.org> | 2019-09-10 19:36:13 +0000 |
| commit | f4365df394d9737584823462a582bca8b2e67458 (patch) | |
| tree | 979db3c9d6fc0333445c369f94b7cdc92078d7ed /sys/arch/armv7/imx | |
| parent | 19ed0ac053cbb1159a7c4251642353c966ec009c (diff) | |
Do not decrement the number of VMs counter twice in one of vm_create()
error paths. If creation of the first VM fails, the counter will wrap
around to a huge value. The same value could later be passed to malloc()
through vm_get_info() causing a panic.
While here, only decrement the same counter in vm_teardown() if the VM
has a valid ID. Otherwise it has not been accounted for.
ok mlarkin@
Reported-by: syzbot+d325bc014d9eca9f36d0@syzkaller.appspotmail.com
Diffstat (limited to 'sys/arch/armv7/imx')
0 files changed, 0 insertions, 0 deletions