diff options
| author | Tobias Schumacher <ts@linux.ibm.com> | 2026-10-09 08:15:48 +0200 |
|---|---|---|
| committer | Heiko Carstens <hca@linux.ibm.com> | 2026-10-13 17:01:46 +0200 |
| commit | 31c66bd273303590fe69fad370e72a12faa0bf76 (patch) | |
| tree | 48281016f5b2a931206ae786c735eb2c29ee20a4 /tools/perf/scripts/python/bin/stackcollapse-report | |
| parent | 2ba01cf7b2598571486425a0605f1434909b532d (diff) | |
| download | linux-31c66bd273303590fe69fad370e72a12faa0bf76.tar.gz linux-31c66bd273303590fe69fad370e72a12faa0bf76.zip | |
s390/pci: Fix double-free and NULL deref in zpci MSI domain cleanup
zpci_remove_parent_msi_domain() dereferences zbus->msi_parent_domain
unconditionally and does not clear it afterwards.
zpci_bus_create_pci_bus() removes the domain when pci_create_root_bus()
fails, then zpci_bus_release() removes it again on the last kref_put(),
reading ->fwnode from the freed irq_domain and freeing it twice.
If zpci_alloc_domain() or zpci_create_parent_msi_domain() fails, no domain
is created at all; zbus is kzalloc'd, so the same release path dereferences
NULL.
Return early when there is no domain, and clear the pointer after removing
one.
Fixes: f770950a4709 ("s390/pci: Migrate s390 IRQ logic to IRQ domain API")
Cc: stable@vger.kernel.org
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Tobias Schumacher <ts@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Diffstat (limited to 'tools/perf/scripts/python/bin/stackcollapse-report')
0 files changed, 0 insertions, 0 deletions