History

rpmsg: virtio: Fix possible double free in rpmsg_probe()

vch will be free in virtio_rpmsg_release_device() when rpmsg_ns_register_device() fails. There is no need to call kfree() again. Fix this by changing error path from free_vch to free_ctrldev.

Hangyu Hua committed 4 years ago

Commit c2eecef1 parent 1a358d31 file · +2 −3Browse files

Unified · Split

drivers/rpmsg/virtio_rpmsg_bus.c+2−3
@@ -973,7 +973,8 @@ static int rpmsg_probe(struct virtio_device *vdev) · 972 unmodified lines
973 973
974 err = rpmsg_ns_register_device(rpdev_ns);974 err = rpmsg_ns_register_device(rpdev_ns);
975 if (err)975 if (err)
976 goto free_vch;976 /* vch will be free in virtio_rpmsg_release_device() */
977 goto free_ctrldev;
977 }978 }
978 979
979 /*980 /*
@@ -997,8 +998,6 @@ static int rpmsg_probe(struct virtio_device *vdev) · 17 unmodified lines
997 998
998 return 0;999 return 0;
999 1000
1000free_vch:
1001 kfree(vch);
1002free_ctrldev:1001free_ctrldev:
1003 rpmsg_virtio_del_ctrl_dev(rpdev_ctrl);1002 rpmsg_virtio_del_ctrl_dev(rpdev_ctrl);
1004free_coherent:1003free_coherent: