On 08/06/2014 10:01 PM, zhanghailiang wrote: > if (!lock_user_struct(VERIFY_READ, target_mb, msgp, 0)) > return -TARGET_EFAULT; > host_mb = malloc(msgsz+sizeof(long)); > + if (!host_mb) { > + return -TARGET_ENOMEM; > + }
lock_user allocates memory; returning from the middle leaks it. r~