| Message ID | 20200520120306.GD172354@mwanda (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | iio: dummy_evgen: Fix use after free on error in iio_dummy_evgen_create() | expand |
Hi Dan, On 2020-05-20 13:03, Dan Carpenter wrote: > We need to preserve the "iio_evgen->irq_sim_domain" error code before > we free "iio_evgen" otherwise it leads to a use after free. > > Fixes: 337cbeb2c13e ("genirq/irq_sim: Simplify the API") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > drivers/iio/dummy/iio_dummy_evgen.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/iio/dummy/iio_dummy_evgen.c > b/drivers/iio/dummy/iio_dummy_evgen.c > index 409fe0f7df1c..ee85d596e528 100644 > --- a/drivers/iio/dummy/iio_dummy_evgen.c > +++ b/drivers/iio/dummy/iio_dummy_evgen.c > @@ -45,6 +45,8 @@ static struct iio_dummy_eventgen *iio_evgen; > > static int iio_dummy_evgen_create(void) > { > + int ret; > + > iio_evgen = kzalloc(sizeof(*iio_evgen), GFP_KERNEL); > if (!iio_evgen) > return -ENOMEM; > @@ -52,8 +54,9 @@ static int iio_dummy_evgen_create(void) > iio_evgen->irq_sim_domain = irq_domain_create_sim(NULL, > IIO_EVENTGEN_NO); > if (IS_ERR(iio_evgen->irq_sim_domain)) { > + ret = PTR_ERR(iio_evgen->irq_sim_domain); > kfree(iio_evgen); > - return PTR_ERR(iio_evgen->irq_sim_domain); > + return ret; > } > > mutex_init(&iio_evgen->lock); Nice catch. I've applied it to irq/irqchip-next, since the offending patch is queued there. Thanks, M.
diff --git a/drivers/iio/dummy/iio_dummy_evgen.c b/drivers/iio/dummy/iio_dummy_evgen.c index 409fe0f7df1c..ee85d596e528 100644 --- a/drivers/iio/dummy/iio_dummy_evgen.c +++ b/drivers/iio/dummy/iio_dummy_evgen.c @@ -45,6 +45,8 @@ static struct iio_dummy_eventgen *iio_evgen; static int iio_dummy_evgen_create(void) { + int ret; + iio_evgen = kzalloc(sizeof(*iio_evgen), GFP_KERNEL); if (!iio_evgen) return -ENOMEM; @@ -52,8 +54,9 @@ static int iio_dummy_evgen_create(void) iio_evgen->irq_sim_domain = irq_domain_create_sim(NULL, IIO_EVENTGEN_NO); if (IS_ERR(iio_evgen->irq_sim_domain)) { + ret = PTR_ERR(iio_evgen->irq_sim_domain); kfree(iio_evgen); - return PTR_ERR(iio_evgen->irq_sim_domain); + return ret; } mutex_init(&iio_evgen->lock);
We need to preserve the "iio_evgen->irq_sim_domain" error code before we free "iio_evgen" otherwise it leads to a use after free. Fixes: 337cbeb2c13e ("genirq/irq_sim: Simplify the API") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/iio/dummy/iio_dummy_evgen.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)