| Message ID | 20240724162356.992763-1-harshit.m.mogalapalli@oracle.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 8290b567621ba4e3ccf45ec9d67e0507196c5ddc |
| Headers | show |
| Series | [1/2] usb: typec: tipd: Fix dereferencing freeing memory in tps6598x_apply_patch() | expand |
On 24/07/2024 18:23, Harshit Mogalapalli wrote: > release_firmware() already frees fw, fix this my moving release_firmware > after the dereference. > > Fixes: 916b8e5fa73d ("usb: typec: tipd: add error log to provide firmware name and size") > Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> > --- > This is found with smatch, only compile tested > --- > drivers/usb/typec/tipd/core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c > index ea768b19a7f1..eb5596e3406a 100644 > --- a/drivers/usb/typec/tipd/core.c > +++ b/drivers/usb/typec/tipd/core.c > @@ -1191,11 +1191,11 @@ static int tps6598x_apply_patch(struct tps6598x *tps) > dev_info(tps->dev, "Firmware update succeeded\n"); > > release_fw: > - release_firmware(fw); > if (ret) { > dev_err(tps->dev, "Failed to write patch %s of %zu bytes\n", > firmware_name, fw->size); > } > + release_firmware(fw); > > return ret; > }; Hi Harshit, thanks for the fix. Reviewed-by: Javier Carrasco <javier.carrasco@wolfvision.net>
On Wed, Jul 24, 2024 at 09:23:50AM -0700, Harshit Mogalapalli wrote: > release_firmware() already frees fw, fix this my moving release_firmware > after the dereference. > > Fixes: 916b8e5fa73d ("usb: typec: tipd: add error log to provide firmware name and size") > Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> > --- > This is found with smatch, only compile tested > --- > drivers/usb/typec/tipd/core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c > index ea768b19a7f1..eb5596e3406a 100644 > --- a/drivers/usb/typec/tipd/core.c > +++ b/drivers/usb/typec/tipd/core.c > @@ -1191,11 +1191,11 @@ static int tps6598x_apply_patch(struct tps6598x *tps) > dev_info(tps->dev, "Firmware update succeeded\n"); > > release_fw: > - release_firmware(fw); > if (ret) { > dev_err(tps->dev, "Failed to write patch %s of %zu bytes\n", > firmware_name, fw->size); > } > + release_firmware(fw); > > return ret; > }; > -- > 2.45.2
diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c index ea768b19a7f1..eb5596e3406a 100644 --- a/drivers/usb/typec/tipd/core.c +++ b/drivers/usb/typec/tipd/core.c @@ -1191,11 +1191,11 @@ static int tps6598x_apply_patch(struct tps6598x *tps) dev_info(tps->dev, "Firmware update succeeded\n"); release_fw: - release_firmware(fw); if (ret) { dev_err(tps->dev, "Failed to write patch %s of %zu bytes\n", firmware_name, fw->size); } + release_firmware(fw); return ret; };
release_firmware() already frees fw, fix this my moving release_firmware after the dereference. Fixes: 916b8e5fa73d ("usb: typec: tipd: add error log to provide firmware name and size") Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> --- This is found with smatch, only compile tested --- drivers/usb/typec/tipd/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)