History

rpmsg: virtio: Fix possible double free in rpmsg_probe()

vch will be free in virtio_rpmsg_release_device() when rpmsg_ns_register_device() fails. There is no need to call kfree() again. Fix this by changing error path from free_vch to free_ctrldev.

Hangyu Hua committed 4 years ago

Commit c2eecef1 parent 1a358d31 file · +2 −3Browse files

Unified · Split

drivers/rpmsg/virtio_rpmsg_bus.c+2−3
@@ -973,7 +973,8 @@ static int rpmsg_probe(struct virtio_device *vdev) · 972 unmodified lines
973973
974974 err = rpmsg_ns_register_device(rpdev_ns);
975975 if (err)
976− goto free_vch;
976+ /* vch will be free in virtio_rpmsg_release_device() */
977+ goto free_ctrldev;
977978 }
978979
979980 /*
@@ -997,8 +998,6 @@ static int rpmsg_probe(struct virtio_device *vdev) · 17 unmodified lines
997998
998999 return 0;
9991000
1000−free_vch:
1001− kfree(vch);
10021001 free_ctrldev:
10031002 rpmsg_virtio_del_ctrl_dev(rpdev_ctrl);
10041003 free_coherent: