| commit | e0440af8b26c0efa284d276cea634383033d5749 | [log] [tgz] |
|---|---|---|
| author | Hangyu Hua <[email protected]> | Tue Apr 26 14:05:35 2022 +0800 |
| committer | Lee Jones <[email protected]> | Fri Sep 09 11:57:40 2022 +0100 |
| tree | 61f7ae39fe493c304601193ad5f42572253f0d02 | |
| parent | cff4cc7a64e951e04001aedf642c3bfe3fd84a68 [diff] |
BACKPORT: rpmsg: virtio: Fix possible double free in rpmsg_virtio_add_ctrl_dev()
[ Upstream commit 1680939e9ecf7764fba8689cfb3429c2fe2bb23c ]
vch will be free in virtio_rpmsg_release_device() when
rpmsg_ctrldev_register_device() fails. There is no need to call
kfree() again.
Bug: 238479990
Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device")
Signed-off-by: Hangyu Hua <[email protected]>
Tested-by: Arnaud Pouliquen <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Mathieu Poirier <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
Signed-off-by: Lee Jones <[email protected]>
Change-Id: Icc443a671616909cc79d13e4d40982cc21a1eef9
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c index e42234a..d624aab 100644 --- a/drivers/rpmsg/virtio_rpmsg_bus.c +++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -842,7 +842,7 @@ static struct rpmsg_device *rpmsg_virtio_add_ctrl_dev(struct virtio_device *vdev err = rpmsg_ctrldev_register_device(rpdev_ctrl); if (err) { - kfree(vch); + /* vch will be free in virtio_rpmsg_release_device() */ return ERR_PTR(err); }