Commit 821f0f68 authored Oct 02, 2012 by Dan Carpenter Committed by Joerg Roedel Oct 02, 2012

iommu/amd: Fix possible use after free in get_irq_table()



We should return NULL on error instead of the freed pointer.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>

parent bdddadcb

drivers/iommu/amd_iommu.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -3865,6 +3865,7 @@ static struct irq_remap_table *get_irq_table(u16 devid, bool ioapic)
		table->table = kmem_cache_alloc(amd_iommu_irq_cache, GFP_ATOMIC);
		if (!table->table) {
		kfree(table);
		table = NULL;
		goto out;
		}