RDMA/rtrs-clt: Fix possible double free in error case
stable inclusion from stable-v5.10.103 commit 8260f1800f83e667f26c80baa7f0b9d92ae271d7 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I52XLL CVE: CVE-2022-29156 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8260f1800f83e667f26c80baa7f0b9d92ae271d7 -------------------------------- [ Upstream commit 8700af2c ] Callback function rtrs_clt_dev_release() for put_device() calls kfree(clt) to free memory. We shouldn't call kfree(clt) again, and we can't use the clt after kfree too. Replace device_register() with device_initialize() and device_add() so that dev_set_name can() be used appropriately. Move mutex_destroy() to the release function so it can be called in the alloc_clt err path. Fixes: eab09824 ("RDMA/rtrs-clt: Refactor the failure cases in alloc_clt") Link: https://lore.kernel.org/r/20220217030929.323849-1-haris.iqbal@ionos.com Reported-by:Miaoqian Lin <linmq006@gmail.com> Signed-off-by:
Md Haris Iqbal <haris.iqbal@ionos.com> Reviewed-by:
Jack Wang <jinpu.wang@ionos.com> Signed-off-by:
Jason Gunthorpe <jgg@nvidia.com> Signed-off-by:
Sasha Levin <sashal@kernel.org> Signed-off-by:
Chen Jun <chenjun102@huawei.com> Signed-off-by:
Zheng Zengkai <zhengzengkai@huawei.com> Reviewed-by:
Xiu Jianfeng <xiujianfeng@huawei.com>
Loading
Please sign in to comment