github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: ipa: Fix double free of the interrupt structure on config error

Browse Source 
Since ipa_interrupt_init() allocates struct ipa_interrupt in ipa_probe(),
the structure is owned by ipa_probe() and released with
ipa_interrupt_exit() on its error paths and in ipa_remove().  The error
path of ipa_interrupt_config() still frees it with kfree().  If
ipa_interrupt_config() fails (called from ipa_config() via ipa_setup()),
ipa_probe() unwinds through err_interrupt_exit, which frees the same
structure again.

Drop the kfree() from ipa_interrupt_config(); it should only undo what it
set up itself. Drop the leftover initialization and cleanup of
ipa->interrupt now managed in ipa_proble() and ipa_remove() of ipa_main.c.

Fixes: ad1be80d75 ("net: ipa: introduce ipa_interrupt_init()")
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Reviewed-by: Alex Elder <elder@riscstar.com>
Link: https://patch.msgid.link/20261029082100.17722-2-fourier.thomas@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Thomas Fourier 2026-10-29 09:20:55 +01:00 committed by Jakub Kicinski
parent 0a0257228b
commit cb284914e7
1 changed files with 2 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/net/ipa/ipa_interrupt.c
View File

@ -260,10 +260,8 @@ int ipa_interrupt_config(struct ipa *ipa)
interrupt->enabled = 0;
interrupt->suspend_enabled = bitmap_zalloc(ipa->endpoint_count,
GFP_KERNEL);
if (!interrupt->suspend_enabled) {
ret = -ENOMEM;
goto err_kfree;
}
if (!interrupt->suspend_enabled)
return -ENOMEM;
/* Disable IPA interrupt types */
reg = ipa_reg(ipa, IPA_IRQ_EN);
@ -289,8 +287,6 @@ int ipa_interrupt_config(struct ipa *ipa)
goto err_disable_wakeup;
}
ipa->interrupt = interrupt;
return 0;
err_disable_wakeup:
@ -299,8 +295,6 @@ int ipa_interrupt_config(struct ipa *ipa)
free_irq(interrupt->irq, interrupt);
err_free_bitmap:
bitmap_free(interrupt->suspend_enabled);
err_kfree:
kfree(interrupt);
return ret;
}
@ -311,8 +305,6 @@ void ipa_interrupt_deconfig(struct ipa *ipa)
struct ipa_interrupt *interrupt = ipa->interrupt;
struct device *dev = ipa->dev;
ipa->interrupt = NULL;
dev_pm_clear_wake_irq(dev);
(void)device_init_wakeup(dev, false);
free_irq(interrupt->irq, interrupt);