| Message ID | YJZJ2Z5CEqQC5s+1@mwanda (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | dmaengine: idxd: double free of devm_ memory on probe error | expand |
diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c index 2a926bef87f2..b65d28895955 100644 --- a/drivers/dma/idxd/init.c +++ b/drivers/dma/idxd/init.c @@ -318,7 +318,7 @@ static int idxd_setup_internals(struct idxd_device *idxd) rc = idxd_setup_wqs(idxd); if (rc < 0) - goto err_wqs; + return rc; rc = idxd_setup_engines(idxd); if (rc < 0) @@ -345,8 +345,6 @@ static int idxd_setup_internals(struct idxd_device *idxd) err_engine: for (i = 0; i < idxd->max_wqs; i++) put_device(&idxd->wqs[i]->conf_dev); - err_wqs: - kfree(idxd->int_handles); return rc; }
The "idxd->int_handles" pointer is allocated with devm_kcalloc() so freeing it here leads to a double free. Delete the kfree(). Fixes: eb15e7154fbf ("dmaengine: idxd: add interrupt handle request and release support") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/dma/idxd/init.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)