uio: potential double frees if __uio_register_device() fails
[ Upstream commitpull/10/headf019f07ecf
] The uio_unregister_device() function assumes that if "info->uio_dev" is non-NULL that means "info" is fully allocated. Setting info->uio_de has to be the last thing in the function. In the current code, if request_threaded_irq() fails then we return with info->uio_dev set to non-NULL but info is not fully allocated and it can lead to double frees. Fixes:beafc54c4e
("UIO: Add the User IO core code") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
2458e91302
commit
16c6e01a4a
|
@ -841,8 +841,6 @@ int __uio_register_device(struct module *owner,
|
|||
if (ret)
|
||||
goto err_uio_dev_add_attributes;
|
||||
|
||||
info->uio_dev = idev;
|
||||
|
||||
if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) {
|
||||
/*
|
||||
* Note that we deliberately don't use devm_request_irq
|
||||
|
@ -858,6 +856,7 @@ int __uio_register_device(struct module *owner,
|
|||
goto err_request_irq;
|
||||
}
|
||||
|
||||
info->uio_dev = idev;
|
||||
return 0;
|
||||
|
||||
err_request_irq:
|
||||
|
|
Loading…
Reference in New Issue