linux-kernel - Re: [PATCH v2] rpmsg: fix possible refcount leak in rpmsg_register_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220624173621.GC1736477@p14s>
Date:   Fri, 24 Jun 2022 11:36:21 -0600
From:   Mathieu Poirier <mathieu.poirier@...aro.org>
To:     Hangyu Hua <hbh25y@...il.com>
Cc:     bjorn.andersson@...aro.org, gregkh@...uxfoundation.org,
        krzysztof.kozlowski@...aro.org, linux-remoteproc@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] rpmsg: fix possible refcount leak in
 rpmsg_register_device_override()

On Fri, Jun 24, 2022 at 10:41:20AM +0800, Hangyu Hua wrote:
> rpmsg_register_device_override need to call put_device to free vch when
> driver_set_override fails.
> 
> Fix this by adding a put_device() to the error path.
> 
> Fixes: bb17d110cbf2 ("rpmsg: Fix calling device_lock() on non-initialized device")

This is funny... Neither Bjorn nor I have reviewed this patch...

> Signed-off-by: Hangyu Hua <hbh25y@...il.com>
> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@...aro.org>
> ---
> 
> v2: change the commit log.
> 
>  drivers/rpmsg/rpmsg_core.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
> index 290c1f02da10..5a47cad89fdc 100644
> --- a/drivers/rpmsg/rpmsg_core.c
> +++ b/drivers/rpmsg/rpmsg_core.c
> @@ -618,6 +618,7 @@ int rpmsg_register_device_override(struct rpmsg_device *rpdev,
>  					  strlen(driver_override));
>  		if (ret) {
>  			dev_err(dev, "device_set_override failed: %d\n", ret);
> +			put_device(dev);

Applied.

Thanks,
Mathieu

>  			return ret;
>  		}
>  	}
> -- 
> 2.25.1
>