grant_references() allocates a private grant-reference head before
claiming references for the page directory and, for guest-owned buffers,
the data pages. The success path frees the remaining head, but claim
failures and grant_refs_for_buffer() errors return immediately.

Unwind through a common exit path so the private grant-reference head is
released even when granting fails part-way through setup. The caller
still tears down any references already stored in buf->grefs.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
---
 drivers/xen/xen-front-pgdir-shbuf.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/xen/xen-front-pgdir-shbuf.c b/drivers/xen/xen-front-pgdir-shbuf.c
index 9c7d8af6e6a1..428187edf85d 100644
--- a/drivers/xen/xen-front-pgdir-shbuf.c
+++ b/drivers/xen/xen-front-pgdir-shbuf.c
@@ -445,8 +445,10 @@ static int grant_references(struct xen_front_pgdir_shbuf *buf)
 		unsigned long frame;
 
 		cur_ref = gnttab_claim_grant_reference(&priv_gref_head);
-		if (cur_ref < 0)
-			return cur_ref;
+		if (cur_ref < 0) {
+			ret = cur_ref;
+			goto out_free_refs;
+		}
 
 		frame = xen_page_to_gfn(virt_to_page(buf->directory +
 						     PAGE_SIZE * i));
@@ -457,11 +459,13 @@ static int grant_references(struct xen_front_pgdir_shbuf *buf)
 	if (buf->ops->grant_refs_for_buffer) {
 		ret = buf->ops->grant_refs_for_buffer(buf, &priv_gref_head, j);
 		if (ret)
-			return ret;
+			goto out_free_refs;
 	}
 
+	ret = 0;
+out_free_refs:
 	gnttab_free_grant_references(priv_gref_head);
-	return 0;
+	return ret;
 }
 
 /*
-- 
2.54.0

On Mon, 29 Jun 2026, Yousef Alhouseen wrote:
> grant_references() allocates a private grant-reference head before
> claiming references for the page directory and, for guest-owned buffers,
> the data pages. The success path frees the remaining head, but claim
> failures and grant_refs_for_buffer() errors return immediately.
> 
> Unwind through a common exit path so the private grant-reference head is
> released even when granting fails part-way through setup. The caller
> still tears down any references already stored in buf->grefs.
> 
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>

Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>


> ---
>  drivers/xen/xen-front-pgdir-shbuf.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/xen/xen-front-pgdir-shbuf.c b/drivers/xen/xen-front-pgdir-shbuf.c
> index 9c7d8af6e6a1..428187edf85d 100644
> --- a/drivers/xen/xen-front-pgdir-shbuf.c
> +++ b/drivers/xen/xen-front-pgdir-shbuf.c
> @@ -445,8 +445,10 @@ static int grant_references(struct xen_front_pgdir_shbuf *buf)
>  		unsigned long frame;
>  
>  		cur_ref = gnttab_claim_grant_reference(&priv_gref_head);
> -		if (cur_ref < 0)
> -			return cur_ref;
> +		if (cur_ref < 0) {
> +			ret = cur_ref;
> +			goto out_free_refs;
> +		}
>  
>  		frame = xen_page_to_gfn(virt_to_page(buf->directory +
>  						     PAGE_SIZE * i));
> @@ -457,11 +459,13 @@ static int grant_references(struct xen_front_pgdir_shbuf *buf)
>  	if (buf->ops->grant_refs_for_buffer) {
>  		ret = buf->ops->grant_refs_for_buffer(buf, &priv_gref_head, j);
>  		if (ret)
> -			return ret;
> +			goto out_free_refs;
>  	}
>  
> +	ret = 0;
> +out_free_refs:
>  	gnttab_free_grant_references(priv_gref_head);
> -	return 0;
> +	return ret;
>  }
>  
>  /*
> -- 
> 2.54.0
>