CVE-2022-50495

Отчет

The Xen SMP initialization code creates descriptive names for various inter-processor interrupts (IPIs) like reschedule, PMU, and call-function interrupts. These names are allocated dynamically using kasprintf and stored in local variables. When bind_ipi_to_irqhandler or bind_virq_to_irqhandler fails to register an interrupt handler, execution jumps to an error label that invokes xen_smp_intr_free (or xen_smp_intr_free_pv) to clean up. This cleanup releases the interrupt handlers themselves, but since the kasprintf-allocated strings were never stored in any structure that the cleanup function can access, they're simply abandoned in memory. Each initialization failure therefore leaks small amounts of memory—individually insignificant, but potentially problematic during repeated initialization cycles or in environments where Xen SMP setup repeatedly fails. The fix stores these strings where the cleanup path can find and free them.