github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-10 17:11:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: alacritech: fix dma_free_coherent() in error path

Browse Source 
In slic_init_stat_queue(), a series of coherent buffers is allocated
with the length size. The size is then stored in stq->mem_size for
normal deallocation. However, in the error path, stq->mem_size is also
used but is not initialized. This error may leave the freed buffers
mapped, leaking a resource and allowing the device to access freed
memory.

Change the length in error path to size.

Fixes: 60c140df15 ("net: ethernet: slicoss: add slicoss gigabit ethernet driver")
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
Link: https://patch.msgid.link/20261006140912.50828-2-fourier.thomas@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Thomas Fourier 2026-10-06 16:09:09 +02:00 committed by Paolo Abeni
parent e4f25fd86c
commit 05b5019b01
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/ethernet/alacritech/slicoss.c
View File

@ -814,7 +814,7 @@ static int slic_init_stat_queue(struct slic_device *sdev)
free_descs:
while (i--) {
dma_free_coherent(&sdev->pdev->dev, stq->mem_size,
dma_free_coherent(&sdev->pdev->dev, size,
stq->descs[i] - stq->addr_offset[i],
stq->paddr[i] - stq->addr_offset[i]);
}