rpmsg: Avoid double-free in mtk_rpmsg_register_device (231331b2) · Commits · 戴 / test

If rpmsg_register_device fails, it will call mtk_rpmsg_release_device which already frees mdev. Fixes: ("rpmsg: add rpmsg support for mt8183 SCP.") Signed-off-by:

Nicolas Boichat <drinkcat@chromium.org> Reviewed-by:

Mathieu Poirier <mathieu.poirier@linaro.org> Link: https://lore.kernel.org/r/20200903080547.v3.1.I56cf27cd59f4013bd074dc622c8b8248b034a4cc@changeid Signed-off-by:

Bjorn Andersson <bjorn.andersson@linaro.org>

drivers/rpmsg/mtk_rpmsg.c

+1 −8

Original line number	Diff line number	Diff line
		@@ -200,7 +200,6 @@ static int mtk_rpmsg_register_device(struct mtk_rpmsg_rproc_subdev *mtk_subdev,
		struct rpmsg_device *rpdev;
		struct mtk_rpmsg_device *mdev;
		struct platform_device *pdev = mtk_subdev->pdev;
		int ret;

		mdev = kzalloc(sizeof(*mdev), GFP_KERNEL);
		if (!mdev)
		@@ -219,13 +218,7 @@ static int mtk_rpmsg_register_device(struct mtk_rpmsg_rproc_subdev *mtk_subdev,
		rpdev->dev.parent = &pdev->dev;
		rpdev->dev.release = mtk_rpmsg_release_device;

		ret = rpmsg_register_device(rpdev);
		if (ret) {
		kfree(mdev);
		return ret;
		}

		return 0;
		return rpmsg_register_device(rpdev);
		}

		static void mtk_register_device_work_function(struct work_struct *register_work)

Admin message