mailbox: zynq-ipi: fix error handling while device_register() fails
[ Upstream commita6792a0cde
] If device_register() fails, it has two issues: 1. The name allocated by dev_set_name() is leaked. 2. The parent of device is not NULL, device_unregister() is called in zynqmp_ipi_free_mboxes(), it will lead a kernel crash because of removing not added device. Call put_device() to give up the reference, so the name is freed in kobject_cleanup(). Add device registered check in zynqmp_ipi_free_mboxes() to avoid null-ptr-deref. Fixes:4981b82ba2
("mailbox: ZynqMP IPI mailbox controller") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
5b0b974db4
commit
f2d63cefc0
|
@ -493,6 +493,7 @@ static int zynqmp_ipi_mbox_probe(struct zynqmp_ipi_mbox *ipi_mbox,
|
|||
ret = device_register(&ipi_mbox->dev);
|
||||
if (ret) {
|
||||
dev_err(dev, "Failed to register ipi mbox dev.\n");
|
||||
put_device(&ipi_mbox->dev);
|
||||
return ret;
|
||||
}
|
||||
mdev = &ipi_mbox->dev;
|
||||
|
@ -619,7 +620,8 @@ static void zynqmp_ipi_free_mboxes(struct zynqmp_ipi_pdata *pdata)
|
|||
ipi_mbox = &pdata->ipi_mboxes[i];
|
||||
if (ipi_mbox->dev.parent) {
|
||||
mbox_controller_unregister(&ipi_mbox->mbox);
|
||||
device_unregister(&ipi_mbox->dev);
|
||||
if (device_is_registered(&ipi_mbox->dev))
|
||||
device_unregister(&ipi_mbox->dev);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue