aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/cdx/controller/mcdi_functions.c
diff options
context:
space:
mode:
authorDan Carpenter <[email protected]>2025-08-11 10:43:39 +0000
committerVinod Koul <[email protected]>2025-08-20 17:32:04 +0000
commit39aaa337449e71a41d4813be0226a722827ba606 (patch)
tree41dc0bdb6af7e8ceee4b38bf7970a2deadcfd7e3 /drivers/cdx/controller/mcdi_functions.c
parentdmaengine: idxd: Fix refcount underflow on module unload (diff)
downloadkernel-39aaa337449e71a41d4813be0226a722827ba606.tar.gz
kernel-39aaa337449e71a41d4813be0226a722827ba606.zip
dmaengine: idxd: Fix double free in idxd_setup_wqs()
The clean up in idxd_setup_wqs() has had a couple bugs because the error handling is a bit subtle. It's simpler to just re-write it in a cleaner way. The issues here are: 1) If "idxd->max_wqs" is <= 0 then we call put_device(conf_dev) when "conf_dev" hasn't been initialized. 2) If kzalloc_node() fails then again "conf_dev" is invalid. It's either uninitialized or it points to the "conf_dev" from the previous iteration so it leads to a double free. It's better to free partial loop iterations within the loop and then the unwinding at the end can handle whole loop iterations. I also renamed the labels to describe what the goto does and not where the goto was located. Fixes: 3fd2f4bc010c ("dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs") Reported-by: Colin Ian King <[email protected]> Closes: https://lore.kernel.org/all/[email protected]/ Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: Dave Jiang <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Vinod Koul <[email protected]>
Diffstat (limited to 'drivers/cdx/controller/mcdi_functions.c')
0 files changed, 0 insertions, 0 deletions