All of lore.kernel.org
 help / color / mirror / Atom feed
From: Daniele Alessandrelli <daniele.alessandrelli@linux.intel.com>
To: Ohad Ben-Cohen <ohad@wizery.com>,
	Bjorn Andersson <bjorn.andersson@linaro.org>
Cc: linux-remoteproc@vger.kernel.org
Subject: [PATCH] remoteproc: core: Fix rproc->firmware free in rproc_set_firmware()
Date: Mon, 18 Jan 2021 16:59:04 +0000	[thread overview]
Message-ID: <20210118165904.719999-1-daniele.alessandrelli@linux.intel.com> (raw)

From: Daniele Alessandrelli <daniele.alessandrelli@intel.com>

rproc_alloc_firmware() (called by rproc_alloc()) can allocate
rproc->firmware using kstrdup_const() and therefore should be freed
using kfree_const(); however, rproc_set_firmware() frees it using the
simple kfree(). This causes a kernel oops if a constant string is passed
to rproc_alloc() and rproc_set_firmware() is subsequently called.

Fix the above issue by using kfree_const() to free rproc->firmware in
rproc_set_firmware().

Signed-off-by: Daniele Alessandrelli <daniele.alessandrelli@intel.com>
---
 drivers/remoteproc/remoteproc_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 2394eef383e3..ab150765d124 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -1988,7 +1988,7 @@ int rproc_set_firmware(struct rproc *rproc, const char *fw_name)
 		goto out;
 	}
 
-	kfree(rproc->firmware);
+	kfree_const(rproc->firmware);
 	rproc->firmware = p;
 
 out:

base-commit: 8cc8eeffd058f3e7e2d8710a514ffcbc2bd69d28
-- 
2.26.2


             reply	other threads:[~2021-01-18 17:02 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-01-18 16:59 Daniele Alessandrelli [this message]
2021-01-19 18:08 ` [PATCH] remoteproc: core: Fix rproc->firmware free in rproc_set_firmware() Mathieu Poirier
2021-02-09 21:48 ` Mathieu Poirier
2021-02-09 22:50 ` patchwork-bot+linux-remoteproc

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210118165904.719999-1-daniele.alessandrelli@linux.intel.com \
    --to=daniele.alessandrelli@linux.intel.com \
    --cc=bjorn.andersson@linaro.org \
    --cc=linux-remoteproc@vger.kernel.org \
    --cc=ohad@wizery.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.