Re: [PATCH] remoteproc: core: Fix rproc->firmware free in rproc_set_firmware()

From: Mathieu Poirier <mathieu.poirier@linaro.org>
To: Daniele Alessandrelli <daniele.alessandrelli@linux.intel.com>
Cc: Ohad Ben-Cohen <ohad@wizery.com>,
	Bjorn Andersson <bjorn.andersson@linaro.org>,
	linux-remoteproc@vger.kernel.org
Subject: Re: [PATCH] remoteproc: core: Fix rproc->firmware free in rproc_set_firmware()
Date: Tue, 9 Feb 2021 14:48:57 -0700	[thread overview]
Message-ID: <20210209214857.GB1582054@xps15> (raw)
In-Reply-To: <20210118165904.719999-1-daniele.alessandrelli@linux.intel.com>

On Mon, Jan 18, 2021 at 04:59:04PM +0000, Daniele Alessandrelli wrote:
> From: Daniele Alessandrelli <daniele.alessandrelli@intel.com>
> 
> rproc_alloc_firmware() (called by rproc_alloc()) can allocate
> rproc->firmware using kstrdup_const() and therefore should be freed
> using kfree_const(); however, rproc_set_firmware() frees it using the
> simple kfree(). This causes a kernel oops if a constant string is passed
> to rproc_alloc() and rproc_set_firmware() is subsequently called.
> 
> Fix the above issue by using kfree_const() to free rproc->firmware in
> rproc_set_firmware().
> 
> Signed-off-by: Daniele Alessandrelli <daniele.alessandrelli@intel.com>
> ---
>  drivers/remoteproc/remoteproc_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
> index 2394eef383e3..ab150765d124 100644
> --- a/drivers/remoteproc/remoteproc_core.c
> +++ b/drivers/remoteproc/remoteproc_core.c
> @@ -1988,7 +1988,7 @@ int rproc_set_firmware(struct rproc *rproc, const char *fw_name)
>  		goto out;
>  	}
>  
> -	kfree(rproc->firmware);
> +	kfree_const(rproc->firmware);
>  	rproc->firmware = p;

Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>

>  
>  out:
> 
> base-commit: 8cc8eeffd058f3e7e2d8710a514ffcbc2bd69d28
> -- 
> 2.26.2
>