Re: [PATCH] net: mdio: Fix a double free issue in the .remove function

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Le 12/05/2021 à 23:44, Russell King - ARM Linux admin a écrit :
On Wed, May 12, 2021 at 11:35:38PM +0200, Christophe JAILLET wrote:
'bus->mii_bus' have been allocated with 'devm_mdiobus_alloc_size()' in the
probe function. So it must not be freed explicitly or there will be a
double free.

Remove the incorrect 'mdiobus_free' in the remove function.

Yes, this looks correct, thanks.

Reviewed-by: Russell King <rmk+kernel@xxxxxxxxxxxxxxx>

However, there's another issue in this driver that ought to be fixed.

If devm_mdiobus_alloc_size() succeeds, but of_mdiobus_register() fails,
we continue on to the next bus (which I think is reasonable.) We don't
free the bus.

When we come to the remove method however, we will call
mdiobus_unregister() on this existent but not-registered bus. Surely we
don't want to do that?


Hmmm, I don't agree here.

'nexus' is 'kzalloc()'ed.
So the pointers in 'buses[]' are all NULL by default.
We set 'nexus->buses[i] = bus' only when all functions that can fail in the loop have been called. (the very last 'break' is when the array is full)

And in the remove function, we have:
	struct cavium_mdiobus *bus = nexus->buses[i];
	if (!bus)
		continue;

So, this looks safe to me.

CJ



[Index of Archives]     [Kernel Development]     [Kernel Announce]     [Kernel Newbies]     [Linux Networking Development]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Device Mapper]

  Powered by Linux