kevin/linux
1
Fork 0
Code

swiotlb: fix use after free on error handling path

Browse Source 
Don't dereference "mem" after it has been freed.  Flip the
two kfree()s around to address this bug.

Fixes: 26ffb91fa5e0 ("swiotlb: split up the global swiotlb lock")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
This commit is contained in:
Dan Carpenter 2022-07-15 11:19:50 +03:00 committed by Christoph Hellwig
parent 20347fca71
commit 4a97739474
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
kernel/dma/swiotlb.c
View File

@ -979,8 +979,8 @@ static int rmem_swiotlb_device_init(struct reserved_mem *rmem,
mem->areas = kcalloc(nareas, sizeof(*mem->areas),
GFP_KERNEL);
if (!mem->areas) {
kfree(mem);
kfree(mem->slots);
kfree(mem);
return -ENOMEM;
}