diff options
| author | Wolfram Sang <wsa+renesas@sang-engineering.com> | 2026-04-10 15:53:00 +0300 |
|---|---|---|
| committer | Jassi Brar <jassisinghbrar@gmail.com> | 2026-04-13 04:39:02 +0300 |
| commit | c02053a9055d5fdfd32432287cca8958db1d5bc5 (patch) | |
| tree | 039d74644ea00b92673021f43631e48ef19f7349 | |
| parent | 0bd75b7abafb3ed199df830c539c57ef9b62c2a2 (diff) | |
| download | linux-c02053a9055d5fdfd32432287cca8958db1d5bc5.tar.xz | |
mailbox: mailbox-test: free channels on probe error
On probe error, free the previously obtained channels. This not only
prevents a leak, but also UAF scenarios because the client structure
will be removed nonetheless because it was allocated with devm.
Link: https://sashiko.dev/#/patchset/20260327151217.5327-2-wsa%2Brenesas%40sang-engineering.com
Fixes: 8ea4484d0c2b ("mailbox: Add generic mechanism for testing Mailbox Controllers")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
| -rw-r--r-- | drivers/mailbox/mailbox-test.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c index 058c0fe4b9c2..5e68f708205c 100644 --- a/drivers/mailbox/mailbox-test.c +++ b/drivers/mailbox/mailbox-test.c @@ -409,18 +409,27 @@ static int mbox_test_probe(struct platform_device *pdev) if (tdev->rx_channel) { tdev->rx_buffer = devm_kzalloc(&pdev->dev, MBOX_MAX_MSG_LEN, GFP_KERNEL); - if (!tdev->rx_buffer) - return -ENOMEM; + if (!tdev->rx_buffer) { + ret = -ENOMEM; + goto err_free_chans; + } } ret = mbox_test_add_debugfs(pdev, tdev); if (ret) - return ret; + goto err_free_chans; init_waitqueue_head(&tdev->waitq); dev_info(&pdev->dev, "Successfully registered\n"); return 0; + +err_free_chans: + if (tdev->tx_channel) + mbox_free_channel(tdev->tx_channel); + if (tdev->rx_channel) + mbox_free_channel(tdev->rx_channel); + return ret; } static void mbox_test_remove(struct platform_device *pdev) |