| Message ID | 20231001035441.30408-1-dinghao.liu@zju.edu.cn (mailing list archive) |
|---|---|
| State | New, archived |
| Delegated to: | Krzysztof Wilczyński |
| Headers | show |
| Series | [v3] PCI: xgene-msi: Fix a potential UAF in xgene_msi_probe | expand |
diff --git a/drivers/pci/controller/pci-xgene-msi.c b/drivers/pci/controller/pci-xgene-msi.c index 3ce38dfd0d29..0f9b9394399d 100644 --- a/drivers/pci/controller/pci-xgene-msi.c +++ b/drivers/pci/controller/pci-xgene-msi.c @@ -251,10 +251,8 @@ static int xgene_allocate_domains(struct xgene_msi *msi) &xgene_msi_domain_info, msi->inner_domain); - if (!msi->msi_domain) { - irq_domain_remove(msi->inner_domain); + if (!msi->msi_domain) return -ENOMEM; - } return 0; }
xgene_allocate_domains() will call irq_domain_remove() to free msi->inner_domain on failure. However, its caller, xgene_msi_probe(), will also call irq_domain_remove() through xgene_msi_remove() on the same failure, which may lead to a use-after-free. Remove the first irq_domain_remove() and let xgene_free_domains() cleanup domains. Fixes: dcd19de36775 ("PCI: xgene: Add APM X-Gene v1 PCIe MSI/MSIX termination driver") Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> --- Changelog: v2: -Remove irq_domain_remove() instead of nulling msi_domain. v3: -Add 'v3' tag in the title. --- drivers/pci/controller/pci-xgene-msi.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)