[PATCH net-next] dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update()

Dan Carpenter posted 1 patch 1 week, 1 day ago
There is a newer version of this series
drivers/dpll/zl3073x/devlink.c | 1 -
1 file changed, 1 deletion(-)
[PATCH net-next] dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update()
Posted by Dan Carpenter 1 week, 1 day ago
The zl3073x_devlink_flash_prepare() function calls zl3073x_fw_free()
and the caller also calls zl3073x_devlink_flash_update() so it leads
to a double free.  Delete the extra free.

Fixes: a1e891fe4ae8 ("dpll: zl3073x: Implement devlink flash callback")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
 drivers/dpll/zl3073x/devlink.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/dpll/zl3073x/devlink.c b/drivers/dpll/zl3073x/devlink.c
index f55d5309d4f9..ccc22332b346 100644
--- a/drivers/dpll/zl3073x/devlink.c
+++ b/drivers/dpll/zl3073x/devlink.c
@@ -167,7 +167,6 @@ zl3073x_devlink_flash_prepare(struct zl3073x_dev *zldev,
 		zl3073x_devlink_flash_notify(zldev,
 					     "Utility is missing in firmware",
 					     NULL, 0, 0);
-		zl3073x_fw_free(zlfw);
 		return -ENOEXEC;
 	}
 
-- 
2.51.0
Re: [PATCH net-next] dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update()
Posted by Simon Horman 1 week ago
On Tue, Sep 23, 2025 at 02:13:01PM +0300, Dan Carpenter wrote:
> The zl3073x_devlink_flash_prepare() function calls zl3073x_fw_free()
> and the caller also calls zl3073x_devlink_flash_update() so it leads

s/zl3073x_devlink_flash_update/zl3073x_fw_free/ ?

> to a double free.  Delete the extra free.
> 
> Fixes: a1e891fe4ae8 ("dpll: zl3073x: Implement devlink flash callback")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>

Thanks Dan,

Aside from the nit above, this looks good to me.

Reviewed-by: Simon Horman <horms@kernel.org>

...
Re: [PATCH net-next] dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update()
Posted by Dan Carpenter 6 days, 12 hours ago
On Wed, Sep 24, 2025 at 06:00:57PM +0100, Simon Horman wrote:
> On Tue, Sep 23, 2025 at 02:13:01PM +0300, Dan Carpenter wrote:
> > The zl3073x_devlink_flash_prepare() function calls zl3073x_fw_free()
> > and the caller also calls zl3073x_devlink_flash_update() so it leads
> 
> s/zl3073x_devlink_flash_update/zl3073x_fw_free/ ?
> 

Sigh.  Let me resend.

regards,
dan carpenter