lkml.org 
[lkml]   [2016]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.7 100/141] cxl: fix potential NULL dereference in free_adapter()
    Date
    4.7-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Andrew Donnellan <andrew.donnellan@au1.ibm.com>

    commit 8fbaa51d43ef2c6a72849ec34060910723a0365f upstream.

    If kzalloc() fails when allocating adapter->guest in
    cxl_guest_init_adapter(), we call free_adapter() before erroring out.
    free_adapter() in turn attempts to dereference adapter->guest, which in
    this case is NULL.

    In free_adapter(), skip the adapter->guest cleanup if adapter->guest is
    NULL.

    Fixes: 14baf4d9c739 ("cxl: Add guest-specific code")
    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/misc/cxl/guest.c | 16 +++++++++-------
    1 file changed, 9 insertions(+), 7 deletions(-)

    --- a/drivers/misc/cxl/guest.c
    +++ b/drivers/misc/cxl/guest.c
    @@ -1052,16 +1052,18 @@ static void free_adapter(struct cxl *ada
    struct irq_avail *cur;
    int i;

    - if (adapter->guest->irq_avail) {
    - for (i = 0; i < adapter->guest->irq_nranges; i++) {
    - cur = &adapter->guest->irq_avail[i];
    - kfree(cur->bitmap);
    + if (adapter->guest) {
    + if (adapter->guest->irq_avail) {
    + for (i = 0; i < adapter->guest->irq_nranges; i++) {
    + cur = &adapter->guest->irq_avail[i];
    + kfree(cur->bitmap);
    + }
    + kfree(adapter->guest->irq_avail);
    }
    - kfree(adapter->guest->irq_avail);
    + kfree(adapter->guest->status);
    + kfree(adapter->guest);
    }
    - kfree(adapter->guest->status);
    cxl_remove_adapter_nr(adapter);
    - kfree(adapter->guest);
    kfree(adapter);
    }


    \
     
     \ /
      Last update: 2016-10-06 11:44    [W:4.039 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site