summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2018-08-02 11:24:47 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-08-02 11:42:25 +0300
commitf019f07ecf6a6b8bd6d7853bce70925d90af02d1 (patch)
tree306aaab3bd5fbb0dd5939761af519eeba6e6a505
parentc01513b4b29953e6ba8a8d8de77fb5ca2f01c48f (diff)
downloadlinux-f019f07ecf6a6b8bd6d7853bce70925d90af02d1.tar.xz
uio: potential double frees if __uio_register_device() fails
The uio_unregister_device() function assumes that if "info->uio_dev" is non-NULL that means "info" is fully allocated. Setting info->uio_de has to be the last thing in the function. In the current code, if request_threaded_irq() fails then we return with info->uio_dev set to non-NULL but info is not fully allocated and it can lead to double frees. Fixes: beafc54c4e2f ("UIO: Add the User IO core code") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/uio/uio.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 3f76e38e6f30..15ad3469660d 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -953,8 +953,6 @@ int __uio_register_device(struct module *owner,
if (ret)
goto err_uio_dev_add_attributes;
- info->uio_dev = idev;
-
if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) {
/*
* Note that we deliberately don't use devm_request_irq
@@ -971,6 +969,7 @@ int __uio_register_device(struct module *owner,
goto err_request_irq;
}
+ info->uio_dev = idev;
return 0;
err_request_irq: