* [PATCH net-next] dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update()
@ 2025-09-23 11:13 Dan Carpenter
2025-09-24 17:00 ` Simon Horman
2025-09-25 5:14 ` Ivan Vecera
0 siblings, 2 replies; 4+ messages in thread
From: Dan Carpenter @ 2025-09-23 11:13 UTC (permalink / raw)
To: Ivan Vecera
Cc: Prathosh Satish, Vadim Fedorenko, Arkadiusz Kubalewski,
Jiri Pirko, Przemek Kitszel, Jakub Kicinski, netdev, linux-kernel,
kernel-janitors
The zl3073x_devlink_flash_prepare() function calls zl3073x_fw_free()
and the caller also calls zl3073x_devlink_flash_update() so it leads
to a double free. Delete the extra free.
Fixes: a1e891fe4ae8 ("dpll: zl3073x: Implement devlink flash callback")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/dpll/zl3073x/devlink.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/dpll/zl3073x/devlink.c b/drivers/dpll/zl3073x/devlink.c
index f55d5309d4f9..ccc22332b346 100644
--- a/drivers/dpll/zl3073x/devlink.c
+++ b/drivers/dpll/zl3073x/devlink.c
@@ -167,7 +167,6 @@ zl3073x_devlink_flash_prepare(struct zl3073x_dev *zldev,
zl3073x_devlink_flash_notify(zldev,
"Utility is missing in firmware",
NULL, 0, 0);
- zl3073x_fw_free(zlfw);
return -ENOEXEC;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net-next] dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update()
2025-09-23 11:13 [PATCH net-next] dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() Dan Carpenter
@ 2025-09-24 17:00 ` Simon Horman
2025-09-25 13:28 ` Dan Carpenter
2025-09-25 5:14 ` Ivan Vecera
1 sibling, 1 reply; 4+ messages in thread
From: Simon Horman @ 2025-09-24 17:00 UTC (permalink / raw)
To: Dan Carpenter
Cc: Ivan Vecera, Prathosh Satish, Vadim Fedorenko,
Arkadiusz Kubalewski, Jiri Pirko, Przemek Kitszel, Jakub Kicinski,
netdev, linux-kernel, kernel-janitors
On Tue, Sep 23, 2025 at 02:13:01PM +0300, Dan Carpenter wrote:
> The zl3073x_devlink_flash_prepare() function calls zl3073x_fw_free()
> and the caller also calls zl3073x_devlink_flash_update() so it leads
s/zl3073x_devlink_flash_update/zl3073x_fw_free/ ?
> to a double free. Delete the extra free.
>
> Fixes: a1e891fe4ae8 ("dpll: zl3073x: Implement devlink flash callback")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Thanks Dan,
Aside from the nit above, this looks good to me.
Reviewed-by: Simon Horman <horms@kernel.org>
...
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net-next] dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update()
2025-09-23 11:13 [PATCH net-next] dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() Dan Carpenter
2025-09-24 17:00 ` Simon Horman
@ 2025-09-25 5:14 ` Ivan Vecera
1 sibling, 0 replies; 4+ messages in thread
From: Ivan Vecera @ 2025-09-25 5:14 UTC (permalink / raw)
To: Dan Carpenter
Cc: Prathosh Satish, Vadim Fedorenko, Arkadiusz Kubalewski,
Jiri Pirko, Przemek Kitszel, Jakub Kicinski, netdev, linux-kernel,
kernel-janitors
On 23. 09. 25 1:13 odp., Dan Carpenter wrote:
> The zl3073x_devlink_flash_prepare() function calls zl3073x_fw_free()
> and the caller also calls zl3073x_devlink_flash_update() so it leads
> to a double free. Delete the extra free.
>
> Fixes: a1e891fe4ae8 ("dpll: zl3073x: Implement devlink flash callback")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> drivers/dpll/zl3073x/devlink.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/dpll/zl3073x/devlink.c b/drivers/dpll/zl3073x/devlink.c
> index f55d5309d4f9..ccc22332b346 100644
> --- a/drivers/dpll/zl3073x/devlink.c
> +++ b/drivers/dpll/zl3073x/devlink.c
> @@ -167,7 +167,6 @@ zl3073x_devlink_flash_prepare(struct zl3073x_dev *zldev,
> zl3073x_devlink_flash_notify(zldev,
> "Utility is missing in firmware",
> NULL, 0, 0);
> - zl3073x_fw_free(zlfw);
> return -ENOEXEC;
> }
Thanks, Dan!
Reviewed-by: Ivan Vecera <ivecera@redhat.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net-next] dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update()
2025-09-24 17:00 ` Simon Horman
@ 2025-09-25 13:28 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2025-09-25 13:28 UTC (permalink / raw)
To: Simon Horman
Cc: Ivan Vecera, Prathosh Satish, Vadim Fedorenko,
Arkadiusz Kubalewski, Jiri Pirko, Przemek Kitszel, Jakub Kicinski,
netdev, linux-kernel, kernel-janitors
On Wed, Sep 24, 2025 at 06:00:57PM +0100, Simon Horman wrote:
> On Tue, Sep 23, 2025 at 02:13:01PM +0300, Dan Carpenter wrote:
> > The zl3073x_devlink_flash_prepare() function calls zl3073x_fw_free()
> > and the caller also calls zl3073x_devlink_flash_update() so it leads
>
> s/zl3073x_devlink_flash_update/zl3073x_fw_free/ ?
>
Sigh. Let me resend.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-09-25 13:28 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-09-23 11:13 [PATCH net-next] dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() Dan Carpenter
2025-09-24 17:00 ` Simon Horman
2025-09-25 13:28 ` Dan Carpenter
2025-09-25 5:14 ` Ivan Vecera
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).