| Message ID | 20221118024611.112732-3-yuancan@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | sh: intc: Fix UAF and compile error problems | expand |
diff --git a/drivers/sh/intc/core.c b/drivers/sh/intc/core.c index 4a4ad10de758..98079a3ebe8a 100644 --- a/drivers/sh/intc/core.c +++ b/drivers/sh/intc/core.c @@ -387,6 +387,7 @@ int __init register_intc_controller(struct intc_desc *desc) kfree(d->window); err1: + list_del(&d->list); kfree(d); err0: pr_err("unable to allocate INTC memory\n");
If the allocation of d->window failed in register_intc_controller(), it will goto err1 and d will be freed, but d->list will not be removed from intc_list, then list traversal may cause UAF, fix it. Fixes: 2be6bb0c79c7 ("sh: intc: Split up the INTC code.") Signed-off-by: Yuan Can <yuancan@huawei.com> --- drivers/sh/intc/core.c | 1 + 1 file changed, 1 insertion(+)