lkml.org 
[lkml]   [2020]   [Oct]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.9 524/757] rpmsg: Avoid double-free in mtk_rpmsg_register_device
    Date
    From: Nicolas Boichat <drinkcat@chromium.org>

    [ Upstream commit 231331b2dbd71487159a0400d9ffd967eb0d0e08 ]

    If rpmsg_register_device fails, it will call
    mtk_rpmsg_release_device which already frees mdev.

    Fixes: 7017996951fd ("rpmsg: add rpmsg support for mt8183 SCP.")
    Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
    Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
    Link: https://lore.kernel.org/r/20200903080547.v3.1.I56cf27cd59f4013bd074dc622c8b8248b034a4cc@changeid
    Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/rpmsg/mtk_rpmsg.c | 9 +--------
    1 file changed, 1 insertion(+), 8 deletions(-)

    diff --git a/drivers/rpmsg/mtk_rpmsg.c b/drivers/rpmsg/mtk_rpmsg.c
    index 83f2b8804ee98..96a17ec291401 100644
    --- a/drivers/rpmsg/mtk_rpmsg.c
    +++ b/drivers/rpmsg/mtk_rpmsg.c
    @@ -200,7 +200,6 @@ static int mtk_rpmsg_register_device(struct mtk_rpmsg_rproc_subdev *mtk_subdev,
    struct rpmsg_device *rpdev;
    struct mtk_rpmsg_device *mdev;
    struct platform_device *pdev = mtk_subdev->pdev;
    - int ret;

    mdev = kzalloc(sizeof(*mdev), GFP_KERNEL);
    if (!mdev)
    @@ -219,13 +218,7 @@ static int mtk_rpmsg_register_device(struct mtk_rpmsg_rproc_subdev *mtk_subdev,
    rpdev->dev.parent = &pdev->dev;
    rpdev->dev.release = mtk_rpmsg_release_device;

    - ret = rpmsg_register_device(rpdev);
    - if (ret) {
    - kfree(mdev);
    - return ret;
    - }
    -
    - return 0;
    + return rpmsg_register_device(rpdev);
    }

    static void mtk_register_device_work_function(struct work_struct *register_work)
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-10-27 17:19    [W:4.084 / U:0.216 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site