tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

mailbox: mailbox-test: free channels on probe error

On probe error, free the previously obtained channels. This not only
prevents a leak, but also UAF scenarios because the client structure
will be removed nonetheless because it was allocated with devm.

Link: https://sashiko.dev/#/patchset/20260327151217.5327-2-wsa%2Brenesas%40sang-engineering.com
Fixes: 8ea4484d0c2b ("mailbox: Add generic mechanism for testing Mailbox Controllers")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>

authored by

Wolfram Sang and committed by
Jassi Brar c02053a9 0bd75b7a

+12 -3
+12 -3
drivers/mailbox/mailbox-test.c
··· 409 409 if (tdev->rx_channel) { 410 410 tdev->rx_buffer = devm_kzalloc(&pdev->dev, 411 411 MBOX_MAX_MSG_LEN, GFP_KERNEL); 412 - if (!tdev->rx_buffer) 413 - return -ENOMEM; 412 + if (!tdev->rx_buffer) { 413 + ret = -ENOMEM; 414 + goto err_free_chans; 415 + } 414 416 } 415 417 416 418 ret = mbox_test_add_debugfs(pdev, tdev); 417 419 if (ret) 418 - return ret; 420 + goto err_free_chans; 419 421 420 422 init_waitqueue_head(&tdev->waitq); 421 423 dev_info(&pdev->dev, "Successfully registered\n"); 422 424 423 425 return 0; 426 + 427 + err_free_chans: 428 + if (tdev->tx_channel) 429 + mbox_free_channel(tdev->tx_channel); 430 + if (tdev->rx_channel) 431 + mbox_free_channel(tdev->rx_channel); 432 + return ret; 424 433 } 425 434 426 435 static void mbox_test_remove(struct platform_device *pdev)