Commit 5ac188b1 authored Mar 07, 2019 by Dan Carpenter Committed by Linus Torvalds Mar 07, 2019

drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen()

If riocm_get_channel() fails, then we should just return -EINVAL.
Calling riocm_put_channel() will trigger a NULL dereference and
generally we should call put() if the get() didn't succeed.

Link: http://lkml.kernel.org/r/20190110130230.GB27017@kadam


Fixes: b6e8d4aa ("rapidio: add RapidIO channelized messaging driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Alexandre Bounine <alexandre.bounine@idt.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 4b047002

drivers/rapidio/rio_cm.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -1215,7 +1215,9 @@ static int riocm_ch_listen(u16 ch_id)
		riocm_debug(CHOP, "(ch_%d)", ch_id);

		ch = riocm_get_channel(ch_id);
		if (!ch \|\| !riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
		if (!ch)
		return -EINVAL;
		if (!riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
		ret = -EINVAL;
		riocm_put_channel(ch);
		return ret;

Admin message