diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2022-07-15 11:19:50 +0300 |
|---|---|---|
| committer | Christoph Hellwig <hch@lst.de> | 2022-07-18 06:48:46 +0200 |
| commit | 4a97739474c402e0a14cf6a432f1920262f6811c (patch) | |
| tree | 0cf67c6e2458073b26411235dd2261b0f0f55735 /kernel/dma | |
| parent | 20347fca71a387a3751f7bb270062616ddc5317a (diff) | |
swiotlb: fix use after free on error handling path
Don't dereference "mem" after it has been freed. Flip the
two kfree()s around to address this bug.
Fixes: 26ffb91fa5e0 ("swiotlb: split up the global swiotlb lock")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Diffstat (limited to 'kernel/dma')
| -rw-r--r-- | kernel/dma/swiotlb.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c index dcf1459ce723..c50e6fe20f37 100644 --- a/kernel/dma/swiotlb.c +++ b/kernel/dma/swiotlb.c @@ -979,8 +979,8 @@ static int rmem_swiotlb_device_init(struct reserved_mem *rmem, mem->areas = kcalloc(nareas, sizeof(*mem->areas), GFP_KERNEL); if (!mem->areas) { - kfree(mem); kfree(mem->slots); + kfree(mem); return -ENOMEM; } |