mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-28 05:12:49 +00:00
ipack: tpci200: fix many double free issues in tpci200_pci_probe
The function tpci200_register called by tpci200_install and tpci200_unregister called by tpci200_uninstall are in pair. However, tpci200_unregister has some cleanup operations not in the tpci200_register. So the error handling code of tpci200_pci_probe has many different double free issues. Fix this problem by moving those cleanup operations out of tpci200_unregister, into tpci200_pci_remove and reverting the previous commit9272e5d002
("ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe"). Fixes:9272e5d002
("ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe") Cc: stable@vger.kernel.org Reported-by: Dongliang Mu <mudongliangabcd@gmail.com> Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> Link: https://lore.kernel.org/r/20210810100323.3938492-1-mudongliangabcd@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
d77772538f
commit
57a1681095
1 changed files with 18 additions and 18 deletions
|
@ -89,16 +89,13 @@ static void tpci200_unregister(struct tpci200_board *tpci200)
|
|||
free_irq(tpci200->info->pdev->irq, (void *) tpci200);
|
||||
|
||||
pci_iounmap(tpci200->info->pdev, tpci200->info->interface_regs);
|
||||
pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs);
|
||||
|
||||
pci_release_region(tpci200->info->pdev, TPCI200_IP_INTERFACE_BAR);
|
||||
pci_release_region(tpci200->info->pdev, TPCI200_IO_ID_INT_SPACES_BAR);
|
||||
pci_release_region(tpci200->info->pdev, TPCI200_MEM16_SPACE_BAR);
|
||||
pci_release_region(tpci200->info->pdev, TPCI200_MEM8_SPACE_BAR);
|
||||
pci_release_region(tpci200->info->pdev, TPCI200_CFG_MEM_BAR);
|
||||
|
||||
pci_disable_device(tpci200->info->pdev);
|
||||
pci_dev_put(tpci200->info->pdev);
|
||||
}
|
||||
|
||||
static void tpci200_enable_irq(struct tpci200_board *tpci200,
|
||||
|
@ -527,7 +524,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
|
|||
tpci200->info = kzalloc(sizeof(struct tpci200_infos), GFP_KERNEL);
|
||||
if (!tpci200->info) {
|
||||
ret = -ENOMEM;
|
||||
goto out_err_info;
|
||||
goto err_tpci200;
|
||||
}
|
||||
|
||||
pci_dev_get(pdev);
|
||||
|
@ -538,7 +535,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
|
|||
if (ret) {
|
||||
dev_err(&pdev->dev, "Failed to allocate PCI Configuration Memory");
|
||||
ret = -EBUSY;
|
||||
goto out_err_pci_request;
|
||||
goto err_tpci200_info;
|
||||
}
|
||||
tpci200->info->cfg_regs = ioremap(
|
||||
pci_resource_start(pdev, TPCI200_CFG_MEM_BAR),
|
||||
|
@ -546,7 +543,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
|
|||
if (!tpci200->info->cfg_regs) {
|
||||
dev_err(&pdev->dev, "Failed to map PCI Configuration Memory");
|
||||
ret = -EFAULT;
|
||||
goto out_err_ioremap;
|
||||
goto err_request_region;
|
||||
}
|
||||
|
||||
/* Disable byte swapping for 16 bit IP module access. This will ensure
|
||||
|
@ -569,7 +566,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
|
|||
if (ret) {
|
||||
dev_err(&pdev->dev, "error during tpci200 install\n");
|
||||
ret = -ENODEV;
|
||||
goto out_err_install;
|
||||
goto err_cfg_regs;
|
||||
}
|
||||
|
||||
/* Register the carrier in the industry pack bus driver */
|
||||
|
@ -581,7 +578,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
|
|||
dev_err(&pdev->dev,
|
||||
"error registering the carrier on ipack driver\n");
|
||||
ret = -EFAULT;
|
||||
goto out_err_bus_register;
|
||||
goto err_tpci200_install;
|
||||
}
|
||||
|
||||
/* save the bus number given by ipack to logging purpose */
|
||||
|
@ -592,19 +589,16 @@ static int tpci200_pci_probe(struct pci_dev *pdev,
|
|||
tpci200_create_device(tpci200, i);
|
||||
return 0;
|
||||
|
||||
out_err_bus_register:
|
||||
err_tpci200_install:
|
||||
tpci200_uninstall(tpci200);
|
||||
/* tpci200->info->cfg_regs is unmapped in tpci200_uninstall */
|
||||
tpci200->info->cfg_regs = NULL;
|
||||
out_err_install:
|
||||
if (tpci200->info->cfg_regs)
|
||||
iounmap(tpci200->info->cfg_regs);
|
||||
out_err_ioremap:
|
||||
err_cfg_regs:
|
||||
pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs);
|
||||
err_request_region:
|
||||
pci_release_region(pdev, TPCI200_CFG_MEM_BAR);
|
||||
out_err_pci_request:
|
||||
pci_dev_put(pdev);
|
||||
err_tpci200_info:
|
||||
kfree(tpci200->info);
|
||||
out_err_info:
|
||||
pci_dev_put(pdev);
|
||||
err_tpci200:
|
||||
kfree(tpci200);
|
||||
return ret;
|
||||
}
|
||||
|
@ -614,6 +608,12 @@ static void __tpci200_pci_remove(struct tpci200_board *tpci200)
|
|||
ipack_bus_unregister(tpci200->info->ipack_bus);
|
||||
tpci200_uninstall(tpci200);
|
||||
|
||||
pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs);
|
||||
|
||||
pci_release_region(tpci200->info->pdev, TPCI200_CFG_MEM_BAR);
|
||||
|
||||
pci_dev_put(tpci200->info->pdev);
|
||||
|
||||
kfree(tpci200->info);
|
||||
kfree(tpci200);
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue