From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 54721C54E68 for ; Thu, 21 Mar 2024 11:05:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=tckuVi4ydUH6gmYZP1oSAlO8uvBKJqE8HOSoqN1MtbE=; b=fm2RNhvJrGfwYM L3KHoLnJYbDUmOG36yx6h3Zhuw69u4wNpPSm7qgNVeSk3Vyv+F3kbR1eAgmQAsyOmAnvvS/lwqi7P hlybV8L6TTkcgohBJgynHBBlsdmwU6DXdpwvBbh9Ta/S/JqHrzG4RcLVcqOAFbnRzkIIdImBAhC7I gjzEQ5hRhkRIaKELYewic7nE1qAlLGDIwHrQzpKYV4pFdvrTth/YBtzfun1eiw0sh7n58FGXjZTce synwTmDCknOhKzmVMg/fOtCwXp6Q45aBpVEiqSsXeH1QV6lXgjFLAEIXnGIdwziZrXDy0WFLNumw2 2F6GOaNulw7N9e02yKoQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rnGEO-00000002jVI-1HQp; Thu, 21 Mar 2024 11:05:08 +0000 Received: from out30-133.freemail.mail.aliyun.com ([115.124.30.133]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1rnGEJ-00000002jSt-19rl for linux-arm-kernel@lists.infradead.org; Thu, 21 Mar 2024 11:05:06 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1711019098; h=From:To:Subject:Date:Message-Id:MIME-Version; bh=XnmZ1grMEt1sDAoeQK50iTO5lrhMsdeymCczyI8HsBc=; b=oQdW3QsxLVg6fMnBDIXMhRPtrDIjcylJFcUmG3ffNSwdtQQetaEnZZnK1hyE/1hJS3HGQNxKoc/FFNylYrWnzpCfbF+NX6PieLG3nXxDtl3sOp7PkDwPHmGxEqfZyaNkdC93pqflMVHRTeehBux12P+8uUf0o39tr7D6ePMT5Xc= X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R331e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018046049;MF=guanrui.huang@linux.alibaba.com;NM=1;PH=DS;RN=6;SR=0;TI=SMTPD_---0W3-bbO1_1711019095; Received: from localhost(mailfrom:guanrui.huang@linux.alibaba.com fp:SMTPD_---0W3-bbO1_1711019095) by smtp.aliyun-inc.com; Thu, 21 Mar 2024 19:04:56 +0800 From: Guanrui Huang To: maz@kernel.org Cc: shannon.zhao@linux.alibaba.com, tglx@linutronix.de, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Guanrui Huang Subject: [PATCH] irqchip/gic-v3-its: Fix double free on error Date: Thu, 21 Mar 2024 19:04:54 +0800 Message-Id: <20240321110454.89410-1-guanrui.huang@linux.alibaba.com> X-Mailer: git-send-email 2.36.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240321_040503_733302_ED5D4B7E X-CRM114-Status: GOOD ( 11.12 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org In its_vpe_irq_domain_alloc, when its_vpe_init() returns an error with i > 0, its_vpe_irq_domain_free may free bitmap and vprop_page, and then there is a double free in its_vpe_irq_domain_alloc. Fix it by checking if bitmap is empty in its_vpe_irq_domain_alloc. If bitmap is empty and i > 0, means that bitmap have been clear and free in its_vpe_irq_domain_free. Signed-off-by: Guanrui Huang --- drivers/irqchip/irq-gic-v3-its.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index fca888b36680..98a1be90caef 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -4562,9 +4562,14 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq } if (err) { - if (i > 0) + if (i > 0) { its_vpe_irq_domain_free(domain, virq, i); + /* bitmap and vprop_page be freed in its_vpe_irq_domain_free */ + if (bitmap_empty(bitmap, nr_ids)) + return err; + } + its_lpi_free(bitmap, base, nr_ids); its_free_prop_table(vprop_page); } -- 2.36.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel