| Message ID | f8ad9a9e6d7df4cb02731a71a418acca18353380.1620890611.git.christophe.jaillet@wanadoo.fr |
|---|---|
| State | New |
| Headers | show |
| Series | [V2] net: mdio: thunder: Fix a double free issue in the .remove function | expand |
On Thu, May 13, 2021 at 09:44:49AM +0200, Christophe JAILLET wrote: > 'bus->mii_bus' have been allocated with 'devm_mdiobus_alloc_size()' in the > probe function. So it must not be freed explicitly or there will be a > double free. > > Remove the incorrect 'mdiobus_free' in the remove function. This still leaves the unregister of an allocated-but-unregistered bus, which you disagreed with - but I hope as I've pointed out the exact code path in your v1 patch, you'll now realise is a real possibility.
On Thu, May 13, 2021 at 09:44:49AM +0200, Christophe JAILLET wrote: > 'bus->mii_bus' have been allocated with 'devm_mdiobus_alloc_size()' in the > probe function. So it must not be freed explicitly or there will be a > double free. > > Remove the incorrect 'mdiobus_free' in the remove function. > > Fixes: 379d7ac7ca31 ("phy: mdio-thunder: Add driver for Cavium Thunder SoC MDIO buses.") > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Also note that I did review your patch, and give you a reviewed-by for it, which I think should have been carried over to v2 since Andrew's comment was only concerning the formatting of the subject line. The patch content is entirely fine. So, I'll give it again, so patchwork gets the right information: Reviewed-by: Russell King <rmk+kernel@armlinux.org.uk> My comments about the unregistration are a separate bug that should be addressed in a separate follow-on patch. Thanks.
Hello: This patch was applied to netdev/net.git (refs/heads/master): On Thu, 13 May 2021 09:44:49 +0200 you wrote: > 'bus->mii_bus' have been allocated with 'devm_mdiobus_alloc_size()' in the > probe function. So it must not be freed explicitly or there will be a > double free. > > Remove the incorrect 'mdiobus_free' in the remove function. > > Fixes: 379d7ac7ca31 ("phy: mdio-thunder: Add driver for Cavium Thunder SoC MDIO buses.") > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> > > [...] Here is the summary with links: - [V2] net: mdio: thunder: Fix a double free issue in the .remove function https://git.kernel.org/netdev/net/c/a93a0a15876d You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/drivers/net/mdio/mdio-thunder.c b/drivers/net/mdio/mdio-thunder.c index cb1761693b69..822d2cdd2f35 100644 --- a/drivers/net/mdio/mdio-thunder.c +++ b/drivers/net/mdio/mdio-thunder.c @@ -126,7 +126,6 @@ static void thunder_mdiobus_pci_remove(struct pci_dev *pdev) continue; mdiobus_unregister(bus->mii_bus); - mdiobus_free(bus->mii_bus); oct_mdio_writeq(0, bus->register_base + SMI_EN); } pci_release_regions(pdev);
'bus->mii_bus' have been allocated with 'devm_mdiobus_alloc_size()' in the probe function. So it must not be freed explicitly or there will be a double free. Remove the incorrect 'mdiobus_free' in the remove function. Fixes: 379d7ac7ca31 ("phy: mdio-thunder: Add driver for Cavium Thunder SoC MDIO buses.") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> --- v2: indicate in the subject which mdio bus driver has a double free --- drivers/net/mdio/mdio-thunder.c | 1 - 1 file changed, 1 deletion(-)