Merge tag 'rpmsg-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc...

Pull rpmsg updates from Bjorn Andersson:
 "This corrects the check for irq_of_parse_and_map() failures in the
  Qualcomm SMD driver and fixes unregistration and a couple of double
  free in the virtio rpmsg driver"

* tag 'rpmsg-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:
  rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails
  rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl
  rpmsg: virtio: Fix possible double free in rpmsg_virtio_add_ctrl_dev()
  rpmsg: virtio: Fix possible double free in rpmsg_probe()
  rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value

diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
index 764c980..1957b27 100644 (file)
--- a/drivers/rpmsg/qcom_smd.c
+++ b/drivers/rpmsg/qcom_smd.c
@@ -1407,9 +1407,9 @@ static int qcom_smd_parse_edge(struct device *dev,
                edge->name = node->name;
 
        irq = irq_of_parse_and_map(node, 0);
-       if (irq < 0) {
+       if (!irq) {
                dev_err(dev, "required smd interrupt missing\n");
-               ret = irq;
+               ret = -EINVAL;
                goto put_node;
        }
 

diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 3ede25b..905ac79 100644 (file)
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -851,7 +851,7 @@ static struct rpmsg_device *rpmsg_virtio_add_ctrl_dev(struct virtio_device *vdev
 
        err = rpmsg_ctrldev_register_device(rpdev_ctrl);
        if (err) {
-               kfree(vch);
+               /* vch will be free in virtio_rpmsg_release_device() */
                return ERR_PTR(err);
        }
 
@@ -862,7 +862,7 @@ static void rpmsg_virtio_del_ctrl_dev(struct rpmsg_device *rpdev_ctrl)
 {
        if (!rpdev_ctrl)
                return;
-       kfree(to_virtio_rpmsg_channel(rpdev_ctrl));
+       device_unregister(&rpdev_ctrl->dev);
 }
 
 static int rpmsg_probe(struct virtio_device *vdev)
@@ -973,7 +973,8 @@ static int rpmsg_probe(struct virtio_device *vdev)
 
                err = rpmsg_ns_register_device(rpdev_ns);
                if (err)
-                       goto free_vch;
+                       /* vch will be free in virtio_rpmsg_release_device() */
+                       goto free_ctrldev;
        }
 
        /*
@@ -997,8 +998,6 @@ static int rpmsg_probe(struct virtio_device *vdev)
 
        return 0;
 
-free_vch:
-       kfree(vch);
 free_ctrldev:
        rpmsg_virtio_del_ctrl_dev(rpdev_ctrl);
 free_coherent: