Commit 4a977394 authored by Dan Carpenter's avatar Dan Carpenter Committed by Christoph Hellwig
Browse files

swiotlb: fix use after free on error handling path 



Don't dereference "mem" after it has been freed.  Flip the
two kfree()s around to address this bug.

Fixes: 26ffb91fa5e0 ("swiotlb: split up the global swiotlb lock")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent 20347fca

kernel/dma/swiotlb.c

+1 −1
Original line number Diff line number Diff line
@@ -979,8 +979,8 @@ static int rmem_swiotlb_device_init(struct reserved_mem *rmem, 
		mem->areas = kcalloc(nareas, sizeof(*mem->areas),

				GFP_KERNEL);

		if (!mem->areas) {

			kfree(mem);

			kfree(mem->slots);

			kfree(mem);

			return -ENOMEM;

		}