| Message ID | 20220623073605.27386-1-hbh25y@gmail.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | rpmsg: fix possible refcount leak in rpmsg_register_device_override() | expand |
On 23/06/2022 09:36, Hangyu Hua wrote: > [1] commit 1680939e9ecf ("rpmsg: virtio: Fix possible double free in > rpmsg_virtio_add_ctrl_dev()") > [2] commit c2eecefec5df ("rpmsg: virtio: Fix possible double free in > rpmsg_probe()") > [3] commit bb17d110cbf2 ("rpmsg: Fix calling device_lock() on > non-initialized device") I think only the last [3] introduced it, because it's the commit missing put_device in first error path. > > The above three patches merged at the same time introduced a new bug. > [1] and [2] make rpmsg_ns_register_device and rpmsg_ctrldev_register_device > need to call the callback function internally to free vch when it fails. > [3] has an error return path not handled vch. > > Fix this by adding a put_device() to the error path. > > Fixes: bb17d110cbf2 ("rpmsg: Fix calling device_lock() on non-initialized device") > Signed-off-by: Hangyu Hua <hbh25y@gmail.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Best regards, Krzysztof
On 2022/6/23 16:15, Krzysztof Kozlowski wrote: > On 23/06/2022 09:36, Hangyu Hua wrote: >> [1] commit 1680939e9ecf ("rpmsg: virtio: Fix possible double free in >> rpmsg_virtio_add_ctrl_dev()") >> [2] commit c2eecefec5df ("rpmsg: virtio: Fix possible double free in >> rpmsg_probe()") >> [3] commit bb17d110cbf2 ("rpmsg: Fix calling device_lock() on >> non-initialized device") > > I think only the last [3] introduced it, because it's the commit missing > put_device in first error path. > I see. Do i need to change the commit log and then send a v2? >> >> The above three patches merged at the same time introduced a new bug. >> [1] and [2] make rpmsg_ns_register_device and rpmsg_ctrldev_register_device >> need to call the callback function internally to free vch when it fails. >> [3] has an error return path not handled vch. >> >> Fix this by adding a put_device() to the error path. >> >> Fixes: bb17d110cbf2 ("rpmsg: Fix calling device_lock() on non-initialized device") >> Signed-off-by: Hangyu Hua <hbh25y@gmail.com> > > > Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> > > Best regards, > Krzysztof
On 23/06/2022 12:53, Hangyu Hua wrote: > On 2022/6/23 16:15, Krzysztof Kozlowski wrote: >> On 23/06/2022 09:36, Hangyu Hua wrote: >>> [1] commit 1680939e9ecf ("rpmsg: virtio: Fix possible double free in >>> rpmsg_virtio_add_ctrl_dev()") >>> [2] commit c2eecefec5df ("rpmsg: virtio: Fix possible double free in >>> rpmsg_probe()") >>> [3] commit bb17d110cbf2 ("rpmsg: Fix calling device_lock() on >>> non-initialized device") >> >> I think only the last [3] introduced it, because it's the commit missing >> put_device in first error path. >> > > I see. Do i need to change the commit log and then send a v2? Yes, please. With my Reviewed-by tag. Best regards, Krzysztof
diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c index 290c1f02da10..5a47cad89fdc 100644 --- a/drivers/rpmsg/rpmsg_core.c +++ b/drivers/rpmsg/rpmsg_core.c @@ -618,6 +618,7 @@ int rpmsg_register_device_override(struct rpmsg_device *rpdev, strlen(driver_override)); if (ret) { dev_err(dev, "device_set_override failed: %d\n", ret); + put_device(dev); return ret; } }
[1] commit 1680939e9ecf ("rpmsg: virtio: Fix possible double free in rpmsg_virtio_add_ctrl_dev()") [2] commit c2eecefec5df ("rpmsg: virtio: Fix possible double free in rpmsg_probe()") [3] commit bb17d110cbf2 ("rpmsg: Fix calling device_lock() on non-initialized device") The above three patches merged at the same time introduced a new bug. [1] and [2] make rpmsg_ns_register_device and rpmsg_ctrldev_register_device need to call the callback function internally to free vch when it fails. [3] has an error return path not handled vch. Fix this by adding a put_device() to the error path. Fixes: bb17d110cbf2 ("rpmsg: Fix calling device_lock() on non-initialized device") Signed-off-by: Hangyu Hua <hbh25y@gmail.com> --- drivers/rpmsg/rpmsg_core.c | 1 + 1 file changed, 1 insertion(+)