drivers/rpmsg/rpmsg_core.c | 1 + 1 file changed, 1 insertion(+)
[1] commit 1680939e9ecf ("rpmsg: virtio: Fix possible double free in
rpmsg_virtio_add_ctrl_dev()")
[2] commit c2eecefec5df ("rpmsg: virtio: Fix possible double free in
rpmsg_probe()")
[3] commit bb17d110cbf2 ("rpmsg: Fix calling device_lock() on
non-initialized device")
The above three patches merged at the same time introduced a new bug.
[1] and [2] make rpmsg_ns_register_device and rpmsg_ctrldev_register_device
need to call the callback function internally to free vch when it fails.
[3] has an error return path not handled vch.
Fix this by adding a put_device() to the error path.
Fixes: bb17d110cbf2 ("rpmsg: Fix calling device_lock() on non-initialized device")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
---
drivers/rpmsg/rpmsg_core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
index 290c1f02da10..5a47cad89fdc 100644
--- a/drivers/rpmsg/rpmsg_core.c
+++ b/drivers/rpmsg/rpmsg_core.c
@@ -618,6 +618,7 @@ int rpmsg_register_device_override(struct rpmsg_device *rpdev,
strlen(driver_override));
if (ret) {
dev_err(dev, "device_set_override failed: %d\n", ret);
+ put_device(dev);
return ret;
}
}
--
2.25.1
On 23/06/2022 09:36, Hangyu Hua wrote: > [1] commit 1680939e9ecf ("rpmsg: virtio: Fix possible double free in > rpmsg_virtio_add_ctrl_dev()") > [2] commit c2eecefec5df ("rpmsg: virtio: Fix possible double free in > rpmsg_probe()") > [3] commit bb17d110cbf2 ("rpmsg: Fix calling device_lock() on > non-initialized device") I think only the last [3] introduced it, because it's the commit missing put_device in first error path. > > The above three patches merged at the same time introduced a new bug. > [1] and [2] make rpmsg_ns_register_device and rpmsg_ctrldev_register_device > need to call the callback function internally to free vch when it fails. > [3] has an error return path not handled vch. > > Fix this by adding a put_device() to the error path. > > Fixes: bb17d110cbf2 ("rpmsg: Fix calling device_lock() on non-initialized device") > Signed-off-by: Hangyu Hua <hbh25y@gmail.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Best regards, Krzysztof
On 2022/6/23 16:15, Krzysztof Kozlowski wrote: > On 23/06/2022 09:36, Hangyu Hua wrote: >> [1] commit 1680939e9ecf ("rpmsg: virtio: Fix possible double free in >> rpmsg_virtio_add_ctrl_dev()") >> [2] commit c2eecefec5df ("rpmsg: virtio: Fix possible double free in >> rpmsg_probe()") >> [3] commit bb17d110cbf2 ("rpmsg: Fix calling device_lock() on >> non-initialized device") > > I think only the last [3] introduced it, because it's the commit missing > put_device in first error path. > I see. Do i need to change the commit log and then send a v2? >> >> The above three patches merged at the same time introduced a new bug. >> [1] and [2] make rpmsg_ns_register_device and rpmsg_ctrldev_register_device >> need to call the callback function internally to free vch when it fails. >> [3] has an error return path not handled vch. >> >> Fix this by adding a put_device() to the error path. >> >> Fixes: bb17d110cbf2 ("rpmsg: Fix calling device_lock() on non-initialized device") >> Signed-off-by: Hangyu Hua <hbh25y@gmail.com> > > > Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> > > Best regards, > Krzysztof
On 23/06/2022 12:53, Hangyu Hua wrote: > On 2022/6/23 16:15, Krzysztof Kozlowski wrote: >> On 23/06/2022 09:36, Hangyu Hua wrote: >>> [1] commit 1680939e9ecf ("rpmsg: virtio: Fix possible double free in >>> rpmsg_virtio_add_ctrl_dev()") >>> [2] commit c2eecefec5df ("rpmsg: virtio: Fix possible double free in >>> rpmsg_probe()") >>> [3] commit bb17d110cbf2 ("rpmsg: Fix calling device_lock() on >>> non-initialized device") >> >> I think only the last [3] introduced it, because it's the commit missing >> put_device in first error path. >> > > I see. Do i need to change the commit log and then send a v2? Yes, please. With my Reviewed-by tag. Best regards, Krzysztof
© 2016 - 2024 Red Hat, Inc.