Messages in this thread | | | Subject | Re: [PATCH] net: mdio: Fix a double free issue in the .remove function | From | Christophe JAILLET <> | Date | Thu, 13 May 2021 08:29:01 +0200 |
| |
Le 12/05/2021 à 23:44, Russell King - ARM Linux admin a écrit : > On Wed, May 12, 2021 at 11:35:38PM +0200, Christophe JAILLET wrote: >> 'bus->mii_bus' have been allocated with 'devm_mdiobus_alloc_size()' in the >> probe function. So it must not be freed explicitly or there will be a >> double free. >> >> Remove the incorrect 'mdiobus_free' in the remove function. > > Yes, this looks correct, thanks. > > Reviewed-by: Russell King <rmk+kernel@armlinux.org.uk> > > However, there's another issue in this driver that ought to be fixed. > > If devm_mdiobus_alloc_size() succeeds, but of_mdiobus_register() fails, > we continue on to the next bus (which I think is reasonable.) We don't > free the bus. > > When we come to the remove method however, we will call > mdiobus_unregister() on this existent but not-registered bus. Surely we > don't want to do that? >
Hmmm, I don't agree here.
'nexus' is 'kzalloc()'ed. So the pointers in 'buses[]' are all NULL by default. We set 'nexus->buses[i] = bus' only when all functions that can fail in the loop have been called. (the very last 'break' is when the array is full)
And in the remove function, we have: struct cavium_mdiobus *bus = nexus->buses[i]; if (!bus) continue;
So, this looks safe to me.
CJ
| |