| Message ID | 20250124123043.96112-1-christian.bruel@foss.st.com (mailing list archive) |
|---|---|
| State | New |
| Delegated to: | Krzysztof Wilczyński |
| Headers | show |
| Series | [v2] PCI: endpoint: pci-epf-test: Fix double free Oops | expand |
diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c index ffb534a8e50a..b29e938ee16a 100644 --- a/drivers/pci/endpoint/functions/pci-epf-test.c +++ b/drivers/pci/endpoint/functions/pci-epf-test.c @@ -718,6 +718,7 @@ static int pci_epf_test_set_bar(struct pci_epf *epf) if (ret) { pci_epf_free_space(epf, epf_test->reg[bar], bar, PRIMARY_INTERFACE); + epf_test->reg[bar] = NULL; dev_err(dev, "Failed to set BAR%d\n", bar); if (bar == test_reg_bar) return ret; @@ -909,6 +910,7 @@ static void pci_epf_test_free_space(struct pci_epf *epf) pci_epf_free_space(epf, epf_test->reg[bar], bar, PRIMARY_INTERFACE); + epf_test->reg[bar] = NULL; } }
Fixes an oops found while testing the stm32_pcie ep driver with handling of PERST# deassertion: During EP initialization, pci_epf_test_alloc_space allocates all BARs, which are further freed if epc_set_bar fails (for instance, due to no free inbound window). However, when pci_epc_set_bar fails, the error path: pci_epc_set_bar -> pci_epf_free_space does not reset epf_test->reg[bar]. Then, if the host reboots, PERST# deassertion restarts the BAR allocation sequence with the same allocation failure (no free inbound window), creating a double free situation since epf_test->reg[bar] was deallocated and is still non-NULL. Make sure that pci_epf_alloc_space/pci_epf_free_space are symmetric by resetting epf_test->reg[bar] when memory is deallocated. Reviewed-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Signed-off-by: Christian Bruel <christian.bruel@foss.st.com> --- v2: Cleanup commit message after Niklas comments and add Reviewed-by --- drivers/pci/endpoint/functions/pci-epf-test.c | 2 ++ 1 file changed, 2 insertions(+)