Commit 653eaedf authored by Md Haris Iqbal's avatar Md Haris Iqbal Committed by Zheng Zengkai
Browse files

RDMA/rtrs-clt: Fix possible double free in error case

stable inclusion
from stable-v5.10.103
commit 8260f1800f83e667f26c80baa7f0b9d92ae271d7
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I52XLL
CVE: CVE-2022-29156

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8260f1800f83e667f26c80baa7f0b9d92ae271d7

--------------------------------

[ Upstream commit 8700af2c ]

Callback function rtrs_clt_dev_release() for put_device() calls kfree(clt)
to free memory. We shouldn't call kfree(clt) again, and we can't use the
clt after kfree too.

Replace device_register() with device_initialize() and device_add() so that
dev_set_name can() be used appropriately.

Move mutex_destroy() to the release function so it can be called in
the alloc_clt err path.

Fixes: eab09824 ("RDMA/rtrs-clt: Refactor the failure cases in alloc_clt")
Link: https://lore.kernel.org/r/20220217030929.323849-1-haris.iqbal@ionos.com


Reported-by: default avatarMiaoqian Lin <linmq006@gmail.com>
Signed-off-by: default avatarMd Haris Iqbal <haris.iqbal@ionos.com>
Reviewed-by: default avatarJack Wang <jinpu.wang@ionos.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarChen Jun <chenjun102@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
Reviewed-by: default avatarXiu Jianfeng <xiujianfeng@huawei.com>
parent e37cd6df
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment