Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-01 10:42:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

pinctrl: spacemit: fix double free of map

Browse Source 
The map pointer is freed by pinctrl_utils_free_map().  It must not be a
devm_ pointer or it leads to a double free when the device is unloaded.

This is similar to a couple bugs Harshit Mogalapalli fixed earlier in
commits 3fd976afe9 ("pinctrl: nuvoton: fix a double free in
ma35_pinctrl_dt_node_to_map_func()") and 4575962aee ("pinctrl: sophgo:
fix double free in cv1800_pctrl_dt_node_to_map()").

Fixes: a83c29e1d1 ("pinctrl: spacemit: add support for SpacemiT K1 SoC")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Acked-by: Yixun Lan <dlan@gentoo.org>
Link: https://lore.kernel.org/4b5f1306-dc01-4edc-96d3-b232b930ddf2@stanley.mountain
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
This commit is contained in:
Dan Carpenter 2024-10-23 11:39:47 +03:00 committed by Linus Walleij
parent 3ad8d3ec6d
commit 5a18e2be45
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/pinctrl/spacemit/pinctrl-k1.c
View File

@ -314,7 +314,7 @@ static int spacemit_pctrl_dt_node_to_map(struct pinctrl_dev *pctldev,
if (!grpnames)
return -ENOMEM;
map = devm_kcalloc(dev, ngroups * 2, sizeof(*map), GFP_KERNEL);
map = kcalloc(ngroups * 2, sizeof(*map), GFP_KERNEL);
if (!map)
return -ENOMEM;