mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 16:01:44 -04:00
Code Issues Packages Projects Releases Wiki Activity

mailbox: mailbox-test: free channels on probe error

Browse Source 
On probe error, free the previously obtained channels. This not only
prevents a leak, but also UAF scenarios because the client structure
will be removed nonetheless because it was allocated with devm.

Link: https://sashiko.dev/#/patchset/20260327151217.5327-2-wsa%2Brenesas%40sang-engineering.com
Fixes: 8ea4484d0c ("mailbox: Add generic mechanism for testing Mailbox Controllers")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
This commit is contained in:
Wolfram Sang
2026-04-10 14:53:00 +02:00
committed by Jassi Brar
parent 0bd75b7aba
commit c02053a905
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/mailbox/mailbox-test.c
View File

@@ -409,18 +409,27 @@ static int mbox_test_probe(struct platform_device *pdev)
if (tdev->rx_channel) {
tdev->rx_buffer = devm_kzalloc(&pdev->dev,
MBOX_MAX_MSG_LEN, GFP_KERNEL);
if (!tdev->rx_buffer)
return -ENOMEM;
if (!tdev->rx_buffer) {
ret = -ENOMEM;
goto err_free_chans;
}
}
ret = mbox_test_add_debugfs(pdev, tdev);
if (ret)
return ret;
goto err_free_chans;
init_waitqueue_head(&tdev->waitq);
dev_info(&pdev->dev, "Successfully registered\n");
return 0;
err_free_chans:
if (tdev->tx_channel)
mbox_free_channel(tdev->tx_channel);
if (tdev->rx_channel)
mbox_free_channel(tdev->rx_channel);
return ret;
}
static void mbox_test_remove(struct platform_device *pdev)