papr_hvpipe_dev_create_handle() transfers ownership of src_info with
retain_and_null_ptr(src_info) after anon_inode_getfile() succeeds.
However, retain_and_null_ptr() clears src_info immediately, and the
function then still dereferences src_info in the subsequent list_add().
Store the transferred pointer in a separate variable and use that for
the list insertion.
Manually identified during code review.
Fixes: 6d3789d347a7af5c4b0b2da3af47b8d9da607ab2 ("papr-hvpipe: convert
papr_hvpipe_dev_create_handle() to FD_PREPARE()")
Cc: [email protected]
Signed-off-by: Guangshuo Li <[email protected]>
---
arch/powerpc/platforms/pseries/papr-hvpipe.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/papr-hvpipe.c
b/arch/powerpc/platforms/pseries/papr-hvpipe.c
index 14ae480d060a..497eb967611b 100644
--- a/arch/powerpc/platforms/pseries/papr-hvpipe.c
+++ b/arch/powerpc/platforms/pseries/papr-hvpipe.c
@@ -480,6 +480,7 @@ static const struct file_operations papr_hvpipe_handle_ops
= {
static int papr_hvpipe_dev_create_handle(u32 srcID)
{
struct hvpipe_source_info *src_info __free(kfree) = NULL;
+ struct hvpipe_source_info *owned_src_info;
spin_lock(&hvpipe_src_list_lock);
/*
@@ -509,7 +510,7 @@ static int papr_hvpipe_dev_create_handle(u32 srcID)
if (fdf.err)
return fdf.err;
- retain_and_null_ptr(src_info);
+ owned_src_info = retain_and_null_ptr(src_info);
spin_lock(&hvpipe_src_list_lock);
/*
* If two processes are executing ioctl() for the same
@@ -520,7 +521,7 @@ static int papr_hvpipe_dev_create_handle(u32 srcID)
spin_unlock(&hvpipe_src_list_lock);
return -EALREADY;
}
- list_add(&src_info->list, &hvpipe_src_list);
+ list_add(&owned_src_info->list, &hvpipe_src_list);
spin_unlock(&hvpipe_src_list_lock);
return fd_publish(fdf);
}
--
2.43.0
