Skip to content

Commit 128516e

Browse files
Dan CarpenterMarc Zyngier
authored andcommitted
iio: dummy_evgen: Fix use after free on error in iio_dummy_evgen_create()
We need to preserve the "iio_evgen->irq_sim_domain" error code before we free "iio_evgen" otherwise it leads to a use after free. Fixes: 337cbeb ("genirq/irq_sim: Simplify the API") Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Marc Zyngier <[email protected]>
1 parent c5d6082 commit 128516e

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

drivers/iio/dummy/iio_dummy_evgen.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,15 +45,18 @@ static struct iio_dummy_eventgen *iio_evgen;
4545

4646
static int iio_dummy_evgen_create(void)
4747
{
48+
int ret;
49+
4850
iio_evgen = kzalloc(sizeof(*iio_evgen), GFP_KERNEL);
4951
if (!iio_evgen)
5052
return -ENOMEM;
5153

5254
iio_evgen->irq_sim_domain = irq_domain_create_sim(NULL,
5355
IIO_EVENTGEN_NO);
5456
if (IS_ERR(iio_evgen->irq_sim_domain)) {
57+
ret = PTR_ERR(iio_evgen->irq_sim_domain);
5558
kfree(iio_evgen);
56-
return PTR_ERR(iio_evgen->irq_sim_domain);
59+
return ret;
5760
}
5861

5962
mutex_init(&iio_evgen->lock);

0 commit comments

Comments
 (0)