kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-13 07:31:07 +00:00
Code Issues Releases Packages Activity
linux/drivers/dma/idxd
History
Dan Carpenter ec5430d090 dmaengine: idxd: Fix double free in idxd_setup_wqs() 
[ Upstream commit 39aaa33744 ]

The clean up in idxd_setup_wqs() has had a couple bugs because the error
handling is a bit subtle.  It's simpler to just re-write it in a cleaner
way.  The issues here are:

1) If "idxd->max_wqs" is <= 0 then we call put_device(conf_dev) when
   "conf_dev" hasn't been initialized.
2) If kzalloc_node() fails then again "conf_dev" is invalid.  It's
   either uninitialized or it points to the "conf_dev" from the
   previous iteration so it leads to a double free.

It's better to free partial loop iterations within the loop and then
the unwinding at the end can handle whole loop iterations.  I also
renamed the labels to describe what the goto does and not where the goto
was located.

Fixes: 3fd2f4bc01 ("dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs")
Reported-by: Colin Ian King <colin.i.king@gmail.com>
Closes: https://lore.kernel.org/all/20250811095836.1642093-1-colin.i.king@gmail.com/
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/aJnJW3iYTDDCj9sk@stanley.mountain
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-09-19 16:35:50 +02:00
..
bus.c driver core: have match() callback in struct bus_type take a const * 2024-07-03 15:16:54 +02:00
cdev.c dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using 2025-07-06 11:01:33 +02:00
compat.c driver core: make [device_]driver_attach take a const * 2024-06-20 12:51:42 +02:00
debugfs.c dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue 2024-04-07 13:31:44 +05:30
defaults.c dmaengine: idxd: Add support for device/wq defaults 2023-12-15 17:52:53 +08:00
device.c dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue 2024-04-07 13:31:44 +05:30
dma.c dmaengine: add channel device name to channel registration 2024-06-11 23:55:34 +05:30
idxd.h dmaengine: idxd: Clean up cpumask and hotplug for perfmon 2024-09-10 11:44:13 +02:00
init.c dmaengine: idxd: Fix double free in idxd_setup_wqs() 2025-09-19 16:35:50 +02:00
irq.c dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list 2024-06-11 21:37:25 +05:30
Makefile module: Convert default symbol namespace to string literal 2025-02-08 09:57:05 +01:00
perfmon.c dmaengine updates for v6.12 2024-09-23 14:08:08 -07:00
perfmon.h dmaengine: idxd: Add IDXD performance monitor support 2021-04-25 21:46:12 +05:30
registers.h VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist 2024-05-13 14:07:33 +00:00
submit.c dmaengine: Fix spelling mistakes 2024-09-02 13:56:01 +05:30
sysfs.c dmaengine: idxd: add a write() method for applications to submit work 2024-05-13 14:07:45 +00:00