[PATCH v2 0/3] rpmsg: virtio: fix posseble double free

[PATCH v2 0/3] rpmsg: virtio: fix posseble double free

[Hangyu Hua]

There are double free in rpmsg_probe() and rpmsg_virtio_add_ctrl_dev().
In addition, rpmsg_virtio_del_ctrl_dev() didn't use correct function
to free the object.

v2:
Use a cover letter to integrate the three patches.
Add comments in rpmsg_probe() and rpmsg_virtio_add_ctrl_dev().


Hangyu Hua (2):
  rpmsg: virtio: fix possible double free in rpmsg_probe()
  rpmsg: virtio: fix possible double free in rpmsg_virtio_add_ctrl_dev()
Arnaud Pouliquen (1):
  rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl

 drivers/rpmsg/virtio_rpmsg_bus.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

-- 
2.25.1

[PATCH v2 1/3] rpmsg: virtio: fix possible double free in rpmsg_probe()

[Hangyu Hua]

vch will be free in virtio_rpmsg_release_device() when
rpmsg_ns_register_device() fails. There is no need to call kfree() again.

Fix this by changing error path from free_vch to free_ctrldev.

Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Tested-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
---
 drivers/rpmsg/virtio_rpmsg_bus.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 3ede25b1f2e4..0130d0ba548c 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -973,7 +973,8 @@ static int rpmsg_probe(struct virtio_device *vdev)
 
 		err = rpmsg_ns_register_device(rpdev_ns);
 		if (err)
-			goto free_vch;
+			/* vch will be free in virtio_rpmsg_release_device() */
+			goto free_ctrldev;
 	}
 
 	/*
@@ -997,8 +998,6 @@ static int rpmsg_probe(struct virtio_device *vdev)
 
 	return 0;
 
-free_vch:
-	kfree(vch);
 free_ctrldev:
 	rpmsg_virtio_del_ctrl_dev(rpdev_ctrl);
 free_coherent:
-- 
2.25.1

[PATCH v2 2/3] rpmsg: virtio: fix possible double free in rpmsg_virtio_add_ctrl_dev()

[Hangyu Hua]

vch will be free in virtio_rpmsg_release_device() when
rpmsg_ctrldev_register_device() fails. There is no need to call
kfree() again.

Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Tested-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
---
 drivers/rpmsg/virtio_rpmsg_bus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 0130d0ba548c..291fc1cfab7f 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -851,7 +851,7 @@ static struct rpmsg_device *rpmsg_virtio_add_ctrl_dev(struct virtio_device *vdev
 
 	err = rpmsg_ctrldev_register_device(rpdev_ctrl);
 	if (err) {
-		kfree(vch);
+		/* vch will be free in virtio_rpmsg_release_device() */
 		return ERR_PTR(err);
 	}
 
-- 
2.25.1

[PATCH v2 3/3] rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl

[Hangyu Hua]

Unregister the rpmsg_ctrl device instead of just freeing the
the virtio_rpmsg_channel structure.
This will properly unregister the device and call
virtio_rpmsg_release_device() that frees the structure.

Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device")
Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Cc: Hangyu Hua <hbh25y@gmail.com>
Reviewed-by: Hangyu Hua <hbh25y@gmail.com>
---
 drivers/rpmsg/virtio_rpmsg_bus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 291fc1cfab7f..485e95f506df 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -862,7 +862,7 @@ static void rpmsg_virtio_del_ctrl_dev(struct rpmsg_device *rpdev_ctrl)
 {
 	if (!rpdev_ctrl)
 		return;
-	kfree(to_virtio_rpmsg_channel(rpdev_ctrl));
+	device_unregister(&rpdev_ctrl->dev);
 }
 
 static int rpmsg_probe(struct virtio_device *vdev)
-- 
2.25.1

Re: [PATCH v2 3/3] rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl

[Mathieu Poirier]

On Tue, Apr 26, 2022 at 02:05:36PM +0800, Hangyu Hua wrote:
> Unregister the rpmsg_ctrl device instead of just freeing the
> the virtio_rpmsg_channel structure.
> This will properly unregister the device and call
> virtio_rpmsg_release_device() that frees the structure.
> 
> Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device")
> Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
> Cc: Hangyu Hua <hbh25y@gmail.com>
> Reviewed-by: Hangyu Hua <hbh25y@gmail.com>
> ---
>  drivers/rpmsg/virtio_rpmsg_bus.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
> index 291fc1cfab7f..485e95f506df 100644
> --- a/drivers/rpmsg/virtio_rpmsg_bus.c
> +++ b/drivers/rpmsg/virtio_rpmsg_bus.c
> @@ -862,7 +862,7 @@ static void rpmsg_virtio_del_ctrl_dev(struct rpmsg_device *rpdev_ctrl)
>  {
>  	if (!rpdev_ctrl)
>  		return;
> -	kfree(to_virtio_rpmsg_channel(rpdev_ctrl));
> +	device_unregister(&rpdev_ctrl->dev);

The author of this patch should have been Arnaud, something I have fixed before
applying this set.

Thanks,
Mathieu

>  }
>  
>  static int rpmsg_probe(struct virtio_device *vdev)
> -- 
> 2.25.1
> 

Re: [PATCH v2 3/3] rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl

[Hangyu Hua]

On 2022/4/27 00:56, Mathieu Poirier wrote:
> On Tue, Apr 26, 2022 at 02:05:36PM +0800, Hangyu Hua wrote:
>> Unregister the rpmsg_ctrl device instead of just freeing the
>> the virtio_rpmsg_channel structure.
>> This will properly unregister the device and call
>> virtio_rpmsg_release_device() that frees the structure.
>>
>> Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device")
>> Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
>> Cc: Hangyu Hua <hbh25y@gmail.com>
>> Reviewed-by: Hangyu Hua <hbh25y@gmail.com>
>> ---
>>   drivers/rpmsg/virtio_rpmsg_bus.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
>> index 291fc1cfab7f..485e95f506df 100644
>> --- a/drivers/rpmsg/virtio_rpmsg_bus.c
>> +++ b/drivers/rpmsg/virtio_rpmsg_bus.c
>> @@ -862,7 +862,7 @@ static void rpmsg_virtio_del_ctrl_dev(struct rpmsg_device *rpdev_ctrl)
>>   {
>>   	if (!rpdev_ctrl)
>>   		return;
>> -	kfree(to_virtio_rpmsg_channel(rpdev_ctrl));
>> +	device_unregister(&rpdev_ctrl->dev);
> 
> The author of this patch should have been Arnaud, something I have fixed before
> applying this set.
> 
> Thanks,
> Mathieu
> 

I get it. I'm sorry i thought Signed-off-by and a description in cover 
letter are enough to express. Do i need to do anything else?

Thanks,
Hangyu
>>   }
>>   
>>   static int rpmsg_probe(struct virtio_device *vdev)
>> -- 
>> 2.25.1
>>

Re: [PATCH v2 3/3] rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl

[Mathieu Poirier]

On Tue, 26 Apr 2022 at 20:50, Hangyu Hua <hbh25y@gmail.com> wrote:
>
> On 2022/4/27 00:56, Mathieu Poirier wrote:
> > On Tue, Apr 26, 2022 at 02:05:36PM +0800, Hangyu Hua wrote:
> >> Unregister the rpmsg_ctrl device instead of just freeing the
> >> the virtio_rpmsg_channel structure.
> >> This will properly unregister the device and call
> >> virtio_rpmsg_release_device() that frees the structure.
> >>
> >> Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device")
> >> Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
> >> Cc: Hangyu Hua <hbh25y@gmail.com>
> >> Reviewed-by: Hangyu Hua <hbh25y@gmail.com>
> >> ---
> >>   drivers/rpmsg/virtio_rpmsg_bus.c | 2 +-
> >>   1 file changed, 1 insertion(+), 1 deletion(-)
> >>
> >> diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
> >> index 291fc1cfab7f..485e95f506df 100644
> >> --- a/drivers/rpmsg/virtio_rpmsg_bus.c
> >> +++ b/drivers/rpmsg/virtio_rpmsg_bus.c
> >> @@ -862,7 +862,7 @@ static void rpmsg_virtio_del_ctrl_dev(struct rpmsg_device *rpdev_ctrl)
> >>   {
> >>      if (!rpdev_ctrl)
> >>              return;
> >> -    kfree(to_virtio_rpmsg_channel(rpdev_ctrl));
> >> +    device_unregister(&rpdev_ctrl->dev);
> >
> > The author of this patch should have been Arnaud, something I have fixed before
> > applying this set.
> >
> > Thanks,
> > Mathieu
> >
>
> I get it. I'm sorry i thought Signed-off-by and a description in cover
> letter are enough to express. Do i need to do anything else?

I don't.

>
> Thanks,
> Hangyu
> >>   }
> >>
> >>   static int rpmsg_probe(struct virtio_device *vdev)
> >> --
> >> 2.25.1
> >>