cxl: fix potential NULL dereference in free_adapter()
If kzalloc() fails when allocating adapter->guest in
cxl_guest_init_adapter(), we call free_adapter() before erroring out.
free_adapter() in turn attempts to dereference adapter->guest, which in
this case is NULL.
In free_adapter(), skip the adapter->guest cleanup if adapter->guest is
NULL.
Fixes: 14baf4d9c7
("cxl: Add guest-specific code")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
This commit is contained in:
Родитель
1e44727a0b
Коммит
8fbaa51d43
|
@ -1055,16 +1055,18 @@ static void free_adapter(struct cxl *adapter)
|
|||
struct irq_avail *cur;
|
||||
int i;
|
||||
|
||||
if (adapter->guest->irq_avail) {
|
||||
for (i = 0; i < adapter->guest->irq_nranges; i++) {
|
||||
cur = &adapter->guest->irq_avail[i];
|
||||
kfree(cur->bitmap);
|
||||
if (adapter->guest) {
|
||||
if (adapter->guest->irq_avail) {
|
||||
for (i = 0; i < adapter->guest->irq_nranges; i++) {
|
||||
cur = &adapter->guest->irq_avail[i];
|
||||
kfree(cur->bitmap);
|
||||
}
|
||||
kfree(adapter->guest->irq_avail);
|
||||
}
|
||||
kfree(adapter->guest->irq_avail);
|
||||
kfree(adapter->guest->status);
|
||||
kfree(adapter->guest);
|
||||
}
|
||||
kfree(adapter->guest->status);
|
||||
cxl_remove_adapter_nr(adapter);
|
||||
kfree(adapter->guest);
|
||||
kfree(adapter);
|
||||
}
|
||||
|
||||
|
|
Загрузка…
Ссылка в новой задаче