mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 05:48:40 +00:00
firmware: stratix10-svc: fix a missing check on list iterator
[ Upstream commit5a0793ac66
] The bug is here: pmem->vaddr = NULL; The list iterator 'pmem' will point to a bogus position containing HEAD if the list is empty or no element is found. This case must be checked before any use of the iterator, otherwise it will lead to a invalid memory access. To fix this bug, just gen_pool_free/set NULL/list_del() and return when found, otherwise list_del HEAD and return; Fixes:7ca5ce8965
("firmware: add Intel Stratix10 service layer driver") Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com> Link: https://lore.kernel.org/r/20220414035609.2239-1-xiam0nd.tong@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
d166cee50a
commit
57b91504b5
1 changed files with 6 additions and 6 deletions
|
@ -948,17 +948,17 @@ EXPORT_SYMBOL_GPL(stratix10_svc_allocate_memory);
|
|||
void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
|
||||
{
|
||||
struct stratix10_svc_data_mem *pmem;
|
||||
size_t size = 0;
|
||||
|
||||
list_for_each_entry(pmem, &svc_data_mem, node)
|
||||
if (pmem->vaddr == kaddr) {
|
||||
size = pmem->size;
|
||||
break;
|
||||
gen_pool_free(chan->ctrl->genpool,
|
||||
(unsigned long)kaddr, pmem->size);
|
||||
pmem->vaddr = NULL;
|
||||
list_del(&pmem->node);
|
||||
return;
|
||||
}
|
||||
|
||||
gen_pool_free(chan->ctrl->genpool, (unsigned long)kaddr, size);
|
||||
pmem->vaddr = NULL;
|
||||
list_del(&pmem->node);
|
||||
list_del(&svc_data_mem);
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(stratix10_svc_free_memory);
|
||||
|
||||
|
|
Loading…
Reference in a new issue