Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1628978 > unrolled thread
| Started by | Pan Bian <bianpan201602@163.com> |
|---|---|
| First post | 2017-04-23 12:30 +0200 |
| Last post | 2017-04-24 12:50 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH 1/1] iommu/amd: fix incorrect error handling Pan Bian <bianpan201602@163.com> - 2017-04-23 12:30 +0200
Re: [PATCH 1/1] iommu/amd: fix incorrect error handling Joerg Roedel <joro@8bytes.org> - 2017-04-24 12:50 +0200
| From | Pan Bian <bianpan201602@163.com> |
|---|---|
| Date | 2017-04-23 12:30 +0200 |
| Subject | [PATCH 1/1] iommu/amd: fix incorrect error handling |
| Message-ID | <tzmWe-7fX-7@gated-at.bofh.it> |
From: Pan Bian <bianpan2016@163.com> In function amd_iommu_bind_pasid(), the control flow jumps to label out_free when pasid_state->mm and mm is NULL. And mmput(mm) is called. In function mmput(mm), mm is referenced without validation. This will result in a NULL dereference bug. This patch fixes the bug. Signed-off-by: Pan Bian <bianpan2016@163.com> --- drivers/iommu/amd_iommu_v2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c index 0633439..6629c47 100644 --- a/drivers/iommu/amd_iommu_v2.c +++ b/drivers/iommu/amd_iommu_v2.c @@ -696,9 +696,9 @@ int amd_iommu_bind_pasid(struct pci_dev *pdev, int pasid, out_unregister: mmu_notifier_unregister(&pasid_state->mn, mm); + mmput(mm); out_free: - mmput(mm); free_pasid_state(pasid_state); out: -- 1.9.1
[toc] | [next] | [standalone]
| From | Joerg Roedel <joro@8bytes.org> |
|---|---|
| Date | 2017-04-24 12:50 +0200 |
| Message-ID | <tzJJ8-5V5-23@gated-at.bofh.it> |
| In reply to | #1628978 |
On Sun, Apr 23, 2017 at 06:23:21PM +0800, Pan Bian wrote: > From: Pan Bian <bianpan2016@163.com> > > In function amd_iommu_bind_pasid(), the control flow jumps to label > out_free when pasid_state->mm and mm is NULL. And mmput(mm) is called. > In function mmput(mm), mm is referenced without validation. This will > result in a NULL dereference bug. This patch fixes the bug. > > Signed-off-by: Pan Bian <bianpan2016@163.com> Applied, thanks.
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web