From: Ye Bin yebin10@huawei.com

commit 82b951e6fbd31d85ae7f4feb5f00ddd4c5d256e2 upstream.

If vfio_irq_ctx_alloc() failed will lead to 'name' memory leak.

Fixes: 18c198c96a81 ("vfio/pci: Create persistent INTx handler") Signed-off-by: Ye Bin yebin10@huawei.com Reviewed-by: Kevin Tian kevin.tian@intel.com Acked-by: Reinette Chatre reinette.chatre@intel.com Link: https://lore.kernel.org/r/20240415015029.3699844-1-yebin10@huawei.com Signed-off-by: Alex Williamson alex.williamson@redhat.com [Denis: minor fix to resolve merge conflict.] Signed-off-by: Denis Arefev arefev@swemel.ru --- Backport fix for CVE-2024-38632 Link: https://nvd.nist.gov/vuln/detail/CVE-2024-38632 --- drivers/vfio/pci/vfio_pci_intrs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c index 5b0b7fab3ba1..83498ec1ec0b 100644 --- a/drivers/vfio/pci/vfio_pci_intrs.c +++ b/drivers/vfio/pci/vfio_pci_intrs.c @@ -181,8 +181,10 @@ static int vfio_intx_enable(struct vfio_pci_device *vdev, return -ENOMEM;

vdev->ctx = kzalloc(sizeof(struct vfio_pci_irq_ctx), GFP_KERNEL); - if (!vdev->ctx) + if (!vdev->ctx) { + kfree(name); return -ENOMEM; + }

vdev->num_ctx = 1;