Fixes an oops found while testing the stm32_pcie ep driver with handling
of PERST# deassertion:
During EP initialization, pci_epf_test_alloc_space allocates all BARs,
which are further freed if epc_set_bar fails (for instance, due to
no free inbound window).
However, when pci_epc_set_bar fails, the error path:
pci_epc_set_bar -> pci_epf_free_space
does not reset epf_test->reg[bar].
Then, if the host reboots, PERST# deassertion restarts the BAR allocation
sequence with the same allocation failure (no free inbound window),
creating a double free situation since epf_test->reg[bar] was deallocated
and is still non-NULL.
Make sure that pci_epf_alloc_space/pci_epf_free_space are symmetric
by resetting epf_test->reg[bar] when memory is deallocated.
Reviewed-by: Niklas Cassel <cassel@xxxxxxxxxx>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@xxxxxxxxxx>
Signed-off-by: Christian Bruel <christian.bruel@xxxxxxxxxxx>
---
v2: Cleanup commit message after Niklas comments and add Reviewed-by
---
drivers/pci/endpoint/functions/pci-epf-test.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
index ffb534a8e50a..b29e938ee16a 100644
--- a/drivers/pci/endpoint/functions/pci-epf-test.c
+++ b/drivers/pci/endpoint/functions/pci-epf-test.c
@@ -718,6 +718,7 @@ static int pci_epf_test_set_bar(struct pci_epf *epf)
if (ret) {
pci_epf_free_space(epf, epf_test->reg[bar], bar,
PRIMARY_INTERFACE);
+ epf_test->reg[bar] = NULL;
dev_err(dev, "Failed to set BAR%d\n", bar);
if (bar == test_reg_bar)
return ret;
@@ -909,6 +910,7 @@ static void pci_epf_test_free_space(struct pci_epf *epf)
pci_epf_free_space(epf, epf_test->reg[bar], bar,
PRIMARY_INTERFACE);
+ epf_test->reg[bar] = NULL;
}
}
--
2.34.1
