Commit c02053a9 authored by Wolfram Sang's avatar Wolfram Sang Committed by Jassi Brar
Browse files

mailbox: mailbox-test: free channels on probe error 

On probe error, free the previously obtained channels. This not only
prevents a leak, but also UAF scenarios because the client structure
will be removed nonetheless because it was allocated with devm.

Link: https://sashiko.dev/#/patchset/20260327151217.5327-2-wsa%2Brenesas%40sang-engineering.com


Fixes: 8ea4484d ("mailbox: Add generic mechanism for testing Mailbox Controllers")
Signed-off-by: default avatarWolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: default avatarJassi Brar <jassisinghbrar@gmail.com>
parent 0bd75b7a

drivers/mailbox/mailbox-test.c

+12 −3
Original line number Diff line number Diff line
@@ -409,18 +409,27 @@ static int mbox_test_probe(struct platform_device *pdev) 
	if (tdev->rx_channel) {

		tdev->rx_buffer = devm_kzalloc(&pdev->dev,

					       MBOX_MAX_MSG_LEN, GFP_KERNEL);

		if (!tdev->rx_buffer)

			return -ENOMEM;

		if (!tdev->rx_buffer) {

			ret = -ENOMEM;

			goto err_free_chans;

		}

	}



	ret = mbox_test_add_debugfs(pdev, tdev);

	if (ret)

		return ret;

		goto err_free_chans;



	init_waitqueue_head(&tdev->waitq);

	dev_info(&pdev->dev, "Successfully registered\n");



	return 0;



err_free_chans:

	if (tdev->tx_channel)

		mbox_free_channel(tdev->tx_channel);

	if (tdev->rx_channel)

		mbox_free_channel(tdev->rx_channel);

	return ret;

}



static void mbox_test_remove(struct platform_device *pdev)