diff options
| author | Michael J. Ruhl <[email protected]> | 2017-09-26 13:06:28 +0000 |
|---|---|---|
| committer | Doug Ledford <[email protected]> | 2017-09-27 15:10:36 +0000 |
| commit | b8f42738acaddf67731c34935c0994e09a588ca7 (patch) | |
| tree | fa25955ee1e88f4f3fc0ace472743d977905e210 /drivers/iio/trigger/stm32-timer-trigger.c | |
| parent | Revert "IB/ipoib: Update broadcast object if PKey value was changed in index 0" (diff) | |
| download | kernel-b8f42738acaddf67731c34935c0994e09a588ca7.tar.gz kernel-b8f42738acaddf67731c34935c0994e09a588ca7.zip | |
IB/hfi1: On error, fix use after free during user context setup
During base context setup, if setup_base_ctxt() fails, the context is
deallocated. This is incorrect because the context is referenced on
return, to notify any waiting subcontext. If there are no subcontexts
the pointer will be invalid.
Reorganize the error path so that deallocate_ctxt() is called after all
the possible subcontexts have been notified.
Reviewed-by: Ira Weiny <[email protected]>
Signed-off-by: Michael J. Ruhl <[email protected]>
Signed-off-by: Dennis Dalessandro <[email protected]>
Signed-off-by: Doug Ledford <[email protected]>
Diffstat (limited to 'drivers/iio/trigger/stm32-timer-trigger.c')
0 files changed, 0 insertions, 0 deletions