Messages in this thread |  | | From | Daniel Baluta <> | | Date | Mon, 9 Oct 2023 14:07:33 +0300 | | Subject | Re: [PATCH] firmware/imx-dsp: Fix use_after_free in imx_dsp_setup_channels() |
| |
On Sun, Oct 8, 2023 at 6:30 AM Hao Ge <gehao@kylinos.cn> wrote: > > dsp_chan->name and chan_name points to same block of memory, > because dev_err still needs to be used it,so we need free > it's memory after use to avoid use_after_free. > > Fixes: e527adfb9b7d ("firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()") > Signed-off-by: Hao Ge <gehao@kylinos.cn>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
> --- > drivers/firmware/imx/imx-dsp.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/firmware/imx/imx-dsp.c b/drivers/firmware/imx/imx-dsp.c > index 508eab346fc6..a48a58e0c61f 100644 > --- a/drivers/firmware/imx/imx-dsp.c > +++ b/drivers/firmware/imx/imx-dsp.c > @@ -114,11 +114,11 @@ static int imx_dsp_setup_channels(struct imx_dsp_ipc *dsp_ipc) > dsp_chan->idx = i % 2; > dsp_chan->ch = mbox_request_channel_byname(cl, chan_name); > if (IS_ERR(dsp_chan->ch)) { > - kfree(dsp_chan->name); > ret = PTR_ERR(dsp_chan->ch); > if (ret != -EPROBE_DEFER) > dev_err(dev, "Failed to request mbox chan %s ret %d\n", > chan_name, ret); > + kfree(dsp_chan->name); > goto out; > } > > -- > 2.25.1 >
|  |