summaryrefslogtreecommitdiff
path: root/lib/timerqueue.c
diff options
context:
space:
mode:
authorZhaoJinming <zhaojinming@uniontech.com>2026-05-29 13:37:32 +0800
committerTony Nguyen <anthony.l.nguyen@intel.com>2026-06-22 14:44:50 -0700
commita903afff66d7379c6ece42bd18b2a17f4c79d1a9 (patch)
tree52d7aa919a08d949ecc6325d782534bd19ffde4f /lib/timerqueue.c
parentc0d00c882bc432990d57052a659f9a8bd1f60687 (diff)
ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info
ice_dpll_deinit_info() calls kfree() on several pf->dplls fields (inputs, outputs, eec.input_prio, pps.input_prio) but does not set the pointers to NULL afterward. This leaves dangling pointers in the pf->dplls structure. While not currently exploitable through existing code paths, this is unsafe because: 1. If ice_dpll_init_info() is called again after a deinit (e.g. during driver recovery), and a subsequent allocation within init fails, the error path will jump to deinit_info and call ice_dpll_deinit_info() again. Since some pointers still hold the old freed addresses, this would result in a double-free. 2. Any future code that checks these pointers before use or after free would be unprotected against use-after-free. Follow the common kernel convention of setting pointers to NULL after kfree() so that: - kfree(NULL) is a safe no-op, preventing double-free - NULL checks on these pointers become meaningful This is a preparatory fix for a subsequent patch that routes additional error paths in ice_dpll_init_info() to the deinit_info label. Fixes: d7999f5ea64b ("ice: implement dpll interface to control cgu") Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Diffstat (limited to 'lib/timerqueue.c')
0 files changed, 0 insertions, 0 deletions