xgene_allocate_domains() will call irq_domain_remove() to free
msi->inner_domain on failure. However, its caller, xgene_msi_probe(),
will also call irq_domain_remove() through xgene_msi_remove() on the
same failure, which may lead to a use-after-free. Remove the first
irq_domain_remove() and let xgene_free_domains() cleanup domains.
Fixes: dcd19de36775 ("PCI: xgene: Add APM X-Gene v1 PCIe MSI/MSIX termination driver")
Signed-off-by: Dinghao Liu <dinghao.liu@xxxxxxxxxx>
---
Changelog:
v2: -Remove irq_domain_remove() instead of nulling msi_domain.
v3: -Add 'v3' tag in the title.
---
drivers/pci/controller/pci-xgene-msi.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/pci/controller/pci-xgene-msi.c b/drivers/pci/controller/pci-xgene-msi.c
index 3ce38dfd0d29..0f9b9394399d 100644
--- a/drivers/pci/controller/pci-xgene-msi.c
+++ b/drivers/pci/controller/pci-xgene-msi.c
@@ -251,10 +251,8 @@ static int xgene_allocate_domains(struct xgene_msi *msi)
&xgene_msi_domain_info,
msi->inner_domain);
- if (!msi->msi_domain) {
- irq_domain_remove(msi->inner_domain);
+ if (!msi->msi_domain)
return -ENOMEM;
- }
return 0;
}
--
2.17.1
