xen/front-pgdir-shbuf: free grant reference head on errors

grant_references() allocates a private grant-reference head before
claiming references for the page directory and, for guest-owned buffers,
the data pages. The success path frees the remaining head, but claim
failures and grant_refs_for_buffer() errors return immediately.

Unwind through a common exit path so the private grant-reference head is
released even when granting fails part-way through setup. The caller
still tears down any references already stored in buf->grefs.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260629160517.29340-1-alhouseenyousef@gmail.com>

diff --git a/drivers/xen/xen-front-pgdir-shbuf.c b/drivers/xen/xen-front-pgdir-shbuf.c
index 9c7d8af6e6a19f9b8ba51bcb6c871b31ffc2e169..428187edf85d220f2de11673f65f4a5510e4aa58 100644 (file)
--- a/drivers/xen/xen-front-pgdir-shbuf.c
+++ b/drivers/xen/xen-front-pgdir-shbuf.c
@@ -445,8 +445,10 @@ static int grant_references(struct xen_front_pgdir_shbuf *buf)
                unsigned long frame;
 
                cur_ref = gnttab_claim_grant_reference(&priv_gref_head);
-               if (cur_ref < 0)
-                       return cur_ref;
+               if (cur_ref < 0) {
+                       ret = cur_ref;
+                       goto out_free_refs;
+               }
 
                frame = xen_page_to_gfn(virt_to_page(buf->directory +
                                                     PAGE_SIZE * i));
@@ -457,11 +459,13 @@ static int grant_references(struct xen_front_pgdir_shbuf *buf)
        if (buf->ops->grant_refs_for_buffer) {
                ret = buf->ops->grant_refs_for_buffer(buf, &priv_gref_head, j);
                if (ret)
-                       return ret;
+                       goto out_free_refs;
        }
 
+       ret = 0;
+out_free_refs:
        gnttab_free_grant_references(priv_gref_head);
-       return 0;
+       return ret;
 }
 
 /*