]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
uio: potential double frees if __uio_register_device() fails
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 2 Aug 2018 08:24:47 +0000 (11:24 +0300)
committerJuerg Haefliger <juergh@canonical.com>
Wed, 24 Jul 2019 01:47:35 +0000 (19:47 -0600)
commita52f87fb0fba347b16bd5c3b1c2cda2f66e23240
tree9d3adf357ac5dfa51d309c64eccbc3bd98474d19
parent97e66ca9852c63856723e57d05bf53616287ac05
uio: potential double frees if __uio_register_device() fails

BugLink: https://bugs.launchpad.net/bugs/1836117
[ Upstream commit f019f07ecf6a6b8bd6d7853bce70925d90af02d1 ]

The uio_unregister_device() function assumes that if "info->uio_dev" is
non-NULL that means "info" is fully allocated.  Setting info->uio_de
has to be the last thing in the function.

In the current code, if request_threaded_irq() fails then we return with
info->uio_dev set to non-NULL but info is not fully allocated and it can
lead to double frees.

Fixes: beafc54c4e2f ("UIO: Add the User IO core code")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
drivers/uio/uio.c