Fix dereferencing freed memory 'fw'
Subsystems (2)
PATCH 1/1 Fix dereferencing freed memory 'fw'
smatch reported dereferencing freed memory as below:
'''drivers/usb/typec/tipd/core.c:1196 tps6598x_apply_patch() error: dereferencing freed memory 'fw' '''
Invoking release_firware(fw) just after checking ret.
--- drivers/usb/typec/tipd/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/tipd/core.c +1 -1
@@ -1191,11 +1191,11 @@ static int tps6598x_apply_patch(struct tps6598x *tps)dev_info (tps->dev,"Firmware update succeeded\n" ); release_fw: -release_firmware (fw);if (ret) {dev_err (tps->dev,"Failed to write patch %s of %zu bytes\n" , firmware_name, fw->size); } +release_firmware (fw);return ret; };
Signature · 1 line
2.43.0
Heikki Krogerus
maintainerHi Dipendra,
Thanks for the patch. You forgot the susbsytem and driver from your subject line:
https://docs.kernel.org/process/submitting-patches.html#the-canonical-patch-format
Quoted 8 lines · Dipendra Khadka
smatch reported dereferencing freed memory as below:
'''drivers/usb/typec/tipd/core.c:1196tps6598x_apply_patch()error: dereferencing freed memory 'fw' '''Invoking
release_firware(fw)just after checking ret.Signed-off-by Dipendra Khadka <[email protected]>
This is a use-after-free case, so please add the Fixes tag:
Quoted 23 lines
--- drivers/usb/typec/tipd/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/usb/typec/tipd/core.c +1
-1@@ -1191,11 +1191,11 @@ static int tps6598x_apply_patch(struct tps6598x *tps)dev_info (tps->dev,"Firmware update succeeded\n" ); release_fw: -release_firmware (fw);if (ret) {dev_err (tps->dev,"Failed to write patch %s of %zu bytes\n" , firmware_name, fw->size); } +release_firmware (fw);return ret; };Signature · 1 line
2.43.0
thanks,
Signature · 1 line
heikki
Heikki Krogerus
maintainerQuoted 4 lines · Dipendra Khadka
smatch reported dereferencing freed memory as below:
'''drivers/usb/typec/tipd/core.c:1196tps6598x_apply_patch()error: dereferencing freed memory 'fw' '''
This is only my opinion, but I don't like those '''single triple quotes''' in commit messages - they are just confusing. You don't need to use any kind of quotation marks in cases like this IMO.
thanks,
Signature · 1 line
heikki
Hi Heikki,
Quoted 11 lines · Heikki Krogerus
Quoted 4 lines · Dipendra Khadka
smatch reported dereferencing freed memory as below:
'''drivers/usb/typec/tipd/core.c:1196tps6598x_apply_patch()error: dereferencing freed memory 'fw' '''This is only my opinion, but I don't like those '''single triple quotes''' in commit messages - they are just confusing. You don't need to use any kind of quotation marks in cases like this IMO.
Thanks for the feedback. I will send v2.
Quoted 4 lines
thanks,
--
heikki
Best Regards,
Dipendra Khadka