diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-10-02 11:34:40 +0300 |
|---|---|---|
| committer | Joerg Roedel <joerg.roedel@amd.com> | 2012-10-02 12:08:07 +0200 |
| commit | 821f0f68ca5fa93c757a892129392e751a7407a3 (patch) | |
| tree | c943c1462eba7bbc0355dbd6bbbf6b49c501d0ac /drivers/iommu | |
| parent | bdddadcb0783b965f524b6f43c475390f5f76765 (diff) | |
| download | op-kernel-dev-821f0f68ca5fa93c757a892129392e751a7407a3.zip op-kernel-dev-821f0f68ca5fa93c757a892129392e751a7407a3.tar.gz | |
iommu/amd: Fix possible use after free in get_irq_table()
We should return NULL on error instead of the freed pointer.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Diffstat (limited to 'drivers/iommu')
| -rw-r--r-- | drivers/iommu/amd_iommu.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c index 312dd4d..ff16c5e 100644 --- a/drivers/iommu/amd_iommu.c +++ b/drivers/iommu/amd_iommu.c @@ -3865,6 +3865,7 @@ static struct irq_remap_table *get_irq_table(u16 devid, bool ioapic) table->table = kmem_cache_alloc(amd_iommu_irq_cache, GFP_ATOMIC); if (!table->table) { kfree(table); + table = NULL; goto out; } |
