Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1628978
| From | Pan Bian <bianpan201602@163.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 1/1] iommu/amd: fix incorrect error handling |
| Date | 2017-04-23 12:30 +0200 |
| Message-ID | <tzmWe-7fX-7@gated-at.bofh.it> (permalink) |
| Organization | linux.* mail to news gateway |
From: Pan Bian <bianpan2016@163.com> In function amd_iommu_bind_pasid(), the control flow jumps to label out_free when pasid_state->mm and mm is NULL. And mmput(mm) is called. In function mmput(mm), mm is referenced without validation. This will result in a NULL dereference bug. This patch fixes the bug. Signed-off-by: Pan Bian <bianpan2016@163.com> --- drivers/iommu/amd_iommu_v2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c index 0633439..6629c47 100644 --- a/drivers/iommu/amd_iommu_v2.c +++ b/drivers/iommu/amd_iommu_v2.c @@ -696,9 +696,9 @@ int amd_iommu_bind_pasid(struct pci_dev *pdev, int pasid, out_unregister: mmu_notifier_unregister(&pasid_state->mn, mm); + mmput(mm); out_free: - mmput(mm); free_pasid_state(pasid_state); out: -- 1.9.1
Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread
[PATCH 1/1] iommu/amd: fix incorrect error handling Pan Bian <bianpan201602@163.com> - 2017-04-23 12:30 +0200 Re: [PATCH 1/1] iommu/amd: fix incorrect error handling Joerg Roedel <joro@8bytes.org> - 2017-04-24 12:50 +0200
csiph-web