There are double free in rpmsg_probe() and rpmsg_virtio_add_ctrl_dev().
In addition, rpmsg_virtio_del_ctrl_dev() didn't use correct function
to free the object.
v2:
Use a cover letter to integrate the three patches.
Add comments in rpmsg_probe() and rpmsg_virtio_add_ctrl_dev().
Hangyu Hua (2):
rpmsg: virtio: fix possible double free in rpmsg_probe()
rpmsg: virtio: fix possible double free in rpmsg_virtio_add_ctrl_dev()
Arnaud Pouliquen (1):
rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl
drivers/rpmsg/virtio_rpmsg_bus.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--
2.25.1
vch will be free in virtio_rpmsg_release_device() when
rpmsg_ns_register_device() fails. There is no need to call kfree() again.
Fix this by changing error path from free_vch to free_ctrldev.
Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device")
Signed-off-by: Hangyu Hua <[email protected]>
Tested-by: Arnaud Pouliquen <[email protected]>
---
drivers/rpmsg/virtio_rpmsg_bus.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 3ede25b1f2e4..0130d0ba548c 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -973,7 +973,8 @@ static int rpmsg_probe(struct virtio_device *vdev)
err = rpmsg_ns_register_device(rpdev_ns);
if (err)
- goto free_vch;
+ /* vch will be free in virtio_rpmsg_release_device() */
+ goto free_ctrldev;
}
/*
@@ -997,8 +998,6 @@ static int rpmsg_probe(struct virtio_device *vdev)
return 0;
-free_vch:
- kfree(vch);
free_ctrldev:
rpmsg_virtio_del_ctrl_dev(rpdev_ctrl);
free_coherent:
--
2.25.1
Unregister the rpmsg_ctrl device instead of just freeing the
the virtio_rpmsg_channel structure.
This will properly unregister the device and call
virtio_rpmsg_release_device() that frees the structure.
Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device")
Signed-off-by: Arnaud Pouliquen <[email protected]>
Cc: Hangyu Hua <[email protected]>
Reviewed-by: Hangyu Hua <[email protected]>
---
drivers/rpmsg/virtio_rpmsg_bus.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 291fc1cfab7f..485e95f506df 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -862,7 +862,7 @@ static void rpmsg_virtio_del_ctrl_dev(struct rpmsg_device *rpdev_ctrl)
{
if (!rpdev_ctrl)
return;
- kfree(to_virtio_rpmsg_channel(rpdev_ctrl));
+ device_unregister(&rpdev_ctrl->dev);
}
static int rpmsg_probe(struct virtio_device *vdev)
--
2.25.1
On Tue, Apr 26, 2022 at 02:05:36PM +0800, Hangyu Hua wrote:
> Unregister the rpmsg_ctrl device instead of just freeing the
> the virtio_rpmsg_channel structure.
> This will properly unregister the device and call
> virtio_rpmsg_release_device() that frees the structure.
>
> Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device")
> Signed-off-by: Arnaud Pouliquen <[email protected]>
> Cc: Hangyu Hua <[email protected]>
> Reviewed-by: Hangyu Hua <[email protected]>
> ---
> drivers/rpmsg/virtio_rpmsg_bus.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
> index 291fc1cfab7f..485e95f506df 100644
> --- a/drivers/rpmsg/virtio_rpmsg_bus.c
> +++ b/drivers/rpmsg/virtio_rpmsg_bus.c
> @@ -862,7 +862,7 @@ static void rpmsg_virtio_del_ctrl_dev(struct rpmsg_device *rpdev_ctrl)
> {
> if (!rpdev_ctrl)
> return;
> - kfree(to_virtio_rpmsg_channel(rpdev_ctrl));
> + device_unregister(&rpdev_ctrl->dev);
The author of this patch should have been Arnaud, something I have fixed before
applying this set.
Thanks,
Mathieu
> }
>
> static int rpmsg_probe(struct virtio_device *vdev)
> --
> 2.25.1
>
On 2022/4/27 00:56, Mathieu Poirier wrote:
> On Tue, Apr 26, 2022 at 02:05:36PM +0800, Hangyu Hua wrote:
>> Unregister the rpmsg_ctrl device instead of just freeing the
>> the virtio_rpmsg_channel structure.
>> This will properly unregister the device and call
>> virtio_rpmsg_release_device() that frees the structure.
>>
>> Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device")
>> Signed-off-by: Arnaud Pouliquen <[email protected]>
>> Cc: Hangyu Hua <[email protected]>
>> Reviewed-by: Hangyu Hua <[email protected]>
>> ---
>> drivers/rpmsg/virtio_rpmsg_bus.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
>> index 291fc1cfab7f..485e95f506df 100644
>> --- a/drivers/rpmsg/virtio_rpmsg_bus.c
>> +++ b/drivers/rpmsg/virtio_rpmsg_bus.c
>> @@ -862,7 +862,7 @@ static void rpmsg_virtio_del_ctrl_dev(struct rpmsg_device *rpdev_ctrl)
>> {
>> if (!rpdev_ctrl)
>> return;
>> - kfree(to_virtio_rpmsg_channel(rpdev_ctrl));
>> + device_unregister(&rpdev_ctrl->dev);
>
> The author of this patch should have been Arnaud, something I have fixed before
> applying this set.
>
> Thanks,
> Mathieu
>
I get it. I'm sorry i thought Signed-off-by and a description in cover
letter are enough to express. Do i need to do anything else?
Thanks,
Hangyu
>> }
>>
>> static int rpmsg_probe(struct virtio_device *vdev)
>> --
>> 2.25.1
>>
vch will be free in virtio_rpmsg_release_device() when
rpmsg_ctrldev_register_device() fails. There is no need to call
kfree() again.
Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device")
Signed-off-by: Hangyu Hua <[email protected]>
Tested-by: Arnaud Pouliquen <[email protected]>
---
drivers/rpmsg/virtio_rpmsg_bus.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 0130d0ba548c..291fc1cfab7f 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -851,7 +851,7 @@ static struct rpmsg_device *rpmsg_virtio_add_ctrl_dev(struct virtio_device *vdev
err = rpmsg_ctrldev_register_device(rpdev_ctrl);
if (err) {
- kfree(vch);
+ /* vch will be free in virtio_rpmsg_release_device() */
return ERR_PTR(err);
}
--
2.25.1
On Tue, 26 Apr 2022 at 20:50, Hangyu Hua <[email protected]> wrote:
>
> On 2022/4/27 00:56, Mathieu Poirier wrote:
> > On Tue, Apr 26, 2022 at 02:05:36PM +0800, Hangyu Hua wrote:
> >> Unregister the rpmsg_ctrl device instead of just freeing the
> >> the virtio_rpmsg_channel structure.
> >> This will properly unregister the device and call
> >> virtio_rpmsg_release_device() that frees the structure.
> >>
> >> Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device")
> >> Signed-off-by: Arnaud Pouliquen <[email protected]>
> >> Cc: Hangyu Hua <[email protected]>
> >> Reviewed-by: Hangyu Hua <[email protected]>
> >> ---
> >> drivers/rpmsg/virtio_rpmsg_bus.c | 2 +-
> >> 1 file changed, 1 insertion(+), 1 deletion(-)
> >>
> >> diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
> >> index 291fc1cfab7f..485e95f506df 100644
> >> --- a/drivers/rpmsg/virtio_rpmsg_bus.c
> >> +++ b/drivers/rpmsg/virtio_rpmsg_bus.c
> >> @@ -862,7 +862,7 @@ static void rpmsg_virtio_del_ctrl_dev(struct rpmsg_device *rpdev_ctrl)
> >> {
> >> if (!rpdev_ctrl)
> >> return;
> >> - kfree(to_virtio_rpmsg_channel(rpdev_ctrl));
> >> + device_unregister(&rpdev_ctrl->dev);
> >
> > The author of this patch should have been Arnaud, something I have fixed before
> > applying this set.
> >
> > Thanks,
> > Mathieu
> >
>
> I get it. I'm sorry i thought Signed-off-by and a description in cover
> letter are enough to express. Do i need to do anything else?
I don't.
>
> Thanks,
> Hangyu
> >> }
> >>
> >> static int rpmsg_probe(struct virtio_device *vdev)
> >> --
> >> 2.25.1
> >>