| Message ID | 20210118165904.719999-1-daniele.alessandrelli@linux.intel.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 43d3f2c715cefcfb89b10675728e9bf0d8bb98e3 |
| Headers | show |
| Series | remoteproc: core: Fix rproc->firmware free in rproc_set_firmware() | expand |
Good morning, On Mon, Jan 18, 2021 at 04:59:04PM +0000, Daniele Alessandrelli wrote: > From: Daniele Alessandrelli <daniele.alessandrelli@intel.com> > > rproc_alloc_firmware() (called by rproc_alloc()) can allocate > rproc->firmware using kstrdup_const() and therefore should be freed > using kfree_const(); however, rproc_set_firmware() frees it using the > simple kfree(). This causes a kernel oops if a constant string is passed > to rproc_alloc() and rproc_set_firmware() is subsequently called. > > Fix the above issue by using kfree_const() to free rproc->firmware in > rproc_set_firmware(). > > Signed-off-by: Daniele Alessandrelli <daniele.alessandrelli@intel.com> > --- > drivers/remoteproc/remoteproc_core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c > index 2394eef383e3..ab150765d124 100644 > --- a/drivers/remoteproc/remoteproc_core.c > +++ b/drivers/remoteproc/remoteproc_core.c > @@ -1988,7 +1988,7 @@ int rproc_set_firmware(struct rproc *rproc, const char *fw_name) > goto out; > } > > - kfree(rproc->firmware); > + kfree_const(rproc->firmware); > rproc->firmware = p; Thanks for the fix, I will pick it up shortly. Mathieu > > out: > > base-commit: 8cc8eeffd058f3e7e2d8710a514ffcbc2bd69d28 > -- > 2.26.2 >
On Mon, Jan 18, 2021 at 04:59:04PM +0000, Daniele Alessandrelli wrote: > From: Daniele Alessandrelli <daniele.alessandrelli@intel.com> > > rproc_alloc_firmware() (called by rproc_alloc()) can allocate > rproc->firmware using kstrdup_const() and therefore should be freed > using kfree_const(); however, rproc_set_firmware() frees it using the > simple kfree(). This causes a kernel oops if a constant string is passed > to rproc_alloc() and rproc_set_firmware() is subsequently called. > > Fix the above issue by using kfree_const() to free rproc->firmware in > rproc_set_firmware(). > > Signed-off-by: Daniele Alessandrelli <daniele.alessandrelli@intel.com> > --- > drivers/remoteproc/remoteproc_core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c > index 2394eef383e3..ab150765d124 100644 > --- a/drivers/remoteproc/remoteproc_core.c > +++ b/drivers/remoteproc/remoteproc_core.c > @@ -1988,7 +1988,7 @@ int rproc_set_firmware(struct rproc *rproc, const char *fw_name) > goto out; > } > > - kfree(rproc->firmware); > + kfree_const(rproc->firmware); > rproc->firmware = p; Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org> > > out: > > base-commit: 8cc8eeffd058f3e7e2d8710a514ffcbc2bd69d28 > -- > 2.26.2 >
Hello: This patch was applied to andersson/remoteproc.git (refs/heads/for-next): On Mon, 18 Jan 2021 16:59:04 +0000 you wrote: > From: Daniele Alessandrelli <daniele.alessandrelli@intel.com> > > rproc_alloc_firmware() (called by rproc_alloc()) can allocate > rproc->firmware using kstrdup_const() and therefore should be freed > using kfree_const(); however, rproc_set_firmware() frees it using the > simple kfree(). This causes a kernel oops if a constant string is passed > to rproc_alloc() and rproc_set_firmware() is subsequently called. > > [...] Here is the summary with links: - remoteproc: core: Fix rproc->firmware free in rproc_set_firmware() https://git.kernel.org/andersson/remoteproc/c/43d3f2c715ce You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c index 2394eef383e3..ab150765d124 100644 --- a/drivers/remoteproc/remoteproc_core.c +++ b/drivers/remoteproc/remoteproc_core.c @@ -1988,7 +1988,7 @@ int rproc_set_firmware(struct rproc *rproc, const char *fw_name) goto out; } - kfree(rproc->firmware); + kfree_const(rproc->firmware); rproc->firmware = p; out: