summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorAndrew Donnellan <andrew.donnellan@au1.ibm.com>2016-07-15 07:20:36 (GMT)
committerMichael Ellerman <mpe@ellerman.id.au>2016-07-19 10:12:29 (GMT)
commit8fbaa51d43ef2c6a72849ec34060910723a0365f (patch)
tree8a6fa9290c3075f25b84154f6300cbffe3e94ed9 /drivers
parent1e44727a0b220f6ead12fefcff997354be0f0f02 (diff)
downloadlinux-8fbaa51d43ef2c6a72849ec34060910723a0365f.tar.xz
cxl: fix potential NULL dereference in free_adapter()
If kzalloc() fails when allocating adapter->guest in cxl_guest_init_adapter(), we call free_adapter() before erroring out. free_adapter() in turn attempts to dereference adapter->guest, which in this case is NULL. In free_adapter(), skip the adapter->guest cleanup if adapter->guest is NULL. Fixes: 14baf4d9c739 ("cxl: Add guest-specific code") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/misc/cxl/guest.c16
1 files changed, 9 insertions, 7 deletions
diff --git a/drivers/misc/cxl/guest.c b/drivers/misc/cxl/guest.c
index ee7148e..9aa58a7 100644
--- a/drivers/misc/cxl/guest.c
+++ b/drivers/misc/cxl/guest.c
@@ -1055,16 +1055,18 @@ static void free_adapter(struct cxl *adapter)
struct irq_avail *cur;
int i;
- if (adapter->guest->irq_avail) {
- for (i = 0; i < adapter->guest->irq_nranges; i++) {
- cur = &adapter->guest->irq_avail[i];
- kfree(cur->bitmap);
+ if (adapter->guest) {
+ if (adapter->guest->irq_avail) {
+ for (i = 0; i < adapter->guest->irq_nranges; i++) {
+ cur = &adapter->guest->irq_avail[i];
+ kfree(cur->bitmap);
+ }
+ kfree(adapter->guest->irq_avail);
}
- kfree(adapter->guest->irq_avail);
+ kfree(adapter->guest->status);
+ kfree(adapter->guest);
}
- kfree(adapter->guest->status);
cxl_remove_adapter_nr(adapter);
- kfree(adapter->guest);
kfree(adapter);
}