rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks. This issue has been resolved in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should delete the `front/deploypackage.public.php` file if they are not using the `deploy tasks` feature.
Vulnerability ID: CVE-2022-31082
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/glpi-project/glpi-inventory-plugin
Published: 2022-06-27
File: inc/deploypackage.class.php
Commit message: Merge pull request from GHSA-q6m7-h6rj-5wmw
Commit author: Cédric Anne

Vulnerable version (before fix):
     die("Sorry. You can't access directly to this file"); }  /**  * Manage the deploy packages.  */ public function deployToComputer($computers_id, $packages_id, $users_id)             //Add the new task             $input = [             'name'                    => '[deploy on demand] ' . $this->fields['name'],             'entities_id'             => $computer->fields['entities_id'],             'reprepare_if_successful' => 0,             'is_deploy_on_demand'     => 1,             'is_active'               => 1,             ];             $tasks_id = $pfTask->add($input); 

Fixed version (after fix):
     die("Sorry. You can't access directly to this file"); }  use Glpi\Toolbox\Sanitizer;  /**  * Manage the deploy packages.  */ public function deployToComputer($computers_id, $packages_id, $users_id)             //Add the new task             $input = [                 'name'                    => '[deploy on demand] ' . Sanitizer::dbEscape($this->fields['name']),                 'entities_id'             => $computer->fields['entities_id'],                 'reprepare_if_successful' => 0,                 'is_deploy_on_demand'     => 1,                 'is_active'               => 1,             ];             $tasks_id = $pfTask->add($input); 

Patch:
patch: @@ -35,6 +35,8 @@
     die("Sorry. You can't access directly to this file");
 }
 
+use Glpi\Toolbox\Sanitizer;
+
 /**
  * Manage the deploy packages.
  */
@@ -1889,11 +1891,11 @@ public function deployToComputer($computers_id, $packages_id, $users_id)
 
            //Add the new task
             $input = [
-            'name'                    => '[deploy on demand] ' . $this->fields['name'],
-            'entities_id'             => $computer->fields['entities_id'],
-            'reprepare_if_successful' => 0,
-            'is_deploy_on_demand'     => 1,
-            'is_active'               => 1,
+                'name'                    => '[deploy on demand] ' . Sanitizer::dbEscape($this->fields['name']),
+                'entities_id'             => $computer->fields['entities_id'],
+                'reprepare_if_successful' => 0,
+                'is_deploy_on_demand'     => 1,
+                'is_active'               => 1,
             ];
             $tasks_id = $pfTask->add($input);
path: inc/deploypackage.class.php
Vulnerability: The operatorequals/wormnest repository through 0.4.7 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Vulnerability ID: CVE-2022-31502
CWE: CWE-22
Severity score: 4.9
Project: https://github.com/operatorequals/wormnest
Published: 2022-07-11
File: app.py
Commit message: Merge pull request #8 from porcupineyhairs/FixPathInjection

Fix Path Traversal Vulnerability
Commit author: John Torakis

Vulnerable version (before fix):
 #!/bin/env python from flask import Flask from flask import flash,request,send_file,send_from_directory,redirect,render_template, abort  from werkzeug.utils import secure_filename from ipaddress import ip_address, ip_network def dir_listing(req_path): https://stackoverflow.com/questions/23718236/python-flask-browsing-through-directory-with-files   '''   # Joining the base and the requested path   abs_path = os.path.join(CONFIG['SRV_DIR'], req_path)    # Return 404 if path doesn't exist   if not os.path.exists(abs_path):

Fixed version (after fix):
 #!/bin/env python from flask import Flask from flask import flash,request,send_file,send_from_directory,redirect,render_template, abort, safe_join  from werkzeug.utils import secure_filename from ipaddress import ip_address, ip_network def dir_listing(req_path): https://stackoverflow.com/questions/23718236/python-flask-browsing-through-directory-with-files   '''   # Joining the base and the requested path   abs_path = safe_join(CONFIG['SRV_DIR'], req_path)    # Return 404 if path doesn't exist   if not os.path.exists(abs_path):

Patch:
patch: @@ -1,6 +1,6 @@
 #!/bin/env python
 from flask import Flask
-from flask import flash,request,send_file,send_from_directory,redirect,render_template, abort
+from flask import flash,request,send_file,send_from_directory,redirect,render_template, abort, safe_join
 
 from werkzeug.utils import secure_filename
 from ipaddress import ip_address, ip_network
@@ -116,7 +116,7 @@ def dir_listing(req_path):
 https://stackoverflow.com/questions/23718236/python-flask-browsing-through-directory-with-files
   '''
   # Joining the base and the requested path
-  abs_path = os.path.join(CONFIG['SRV_DIR'], req_path)
+  abs_path = safe_join(CONFIG['SRV_DIR'], req_path)
 
   # Return 404 if path doesn't exist
   if not os.path.exists(abs_path):
path: app.py
Vulnerability: The idayrus/evoting repository before 2022-05-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Vulnerability ID: CVE-2022-31508
CWE: CWE-22
Severity score: 4.9
Project: https://github.com/idayrus/evoting
Published: 2022-07-11
File: app/helper/middleware.py
Commit message: Merge pull request #2 from porcupineyhairs/FixPathInjection

Fix Path Traversal Vulnerability
Commit author: adierebel

Vulnerable version (before fix):
 from app.module.user.model import UserModel, UserTokenModel from app.module.user import UserSession from werkzeug.routing import BaseConverter, ValidationError from bson.objectid import ObjectId from bson.errors import InvalidId from os import path @login_required def private_static(filename):     # Get path     filepath = path.join(app.config.get("PRIVATE_DIR"), filename)     if path.isfile(filepath):         return send_file(filepath)     # End

Fixed version (after fix):
 from app.module.user.model import UserModel, UserTokenModel from app.module.user import UserSession from werkzeug.routing import BaseConverter, ValidationError from werkzeug.utils import safe_join from bson.objectid import ObjectId from bson.errors import InvalidId from os import path @login_required def private_static(filename):     # Get path     filepath = safe_join(app.config.get("PRIVATE_DIR"), filename)     if path.isfile(filepath):         return send_file(filepath)     # End

Patch:
patch: @@ -5,6 +5,7 @@
 from app.module.user.model import UserModel, UserTokenModel
 from app.module.user import UserSession
 from werkzeug.routing import BaseConverter, ValidationError
+from werkzeug.utils import safe_join
 from bson.objectid import ObjectId
 from bson.errors import InvalidId
 from os import path
@@ -18,7 +19,7 @@
 @login_required
 def private_static(filename):
     # Get path
-    filepath = path.join(app.config.get("PRIVATE_DIR"), filename)
+    filepath = safe_join(app.config.get("PRIVATE_DIR"), filename)
     if path.isfile(filepath):
         return send_file(filepath)
     # End
path: app/helper/middleware.py
Vulnerability: Liblouis 3.21.0 has an out-of-bounds write in compileRule in compileTranslationTable.c, as demonstrated by lou_trace.
Vulnerability ID: CVE-2022-31783
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/liblouis/liblouis
Published: 2022-06-02
File: liblouis/compileTranslationTable.c
Commit message: Prevent an invalid memory writes in compileRule

Thanks to Han Zheng for reporting it

Fixes #1214
Commit author: Christian Egli

Vulnerable version (before fix):
 compileRule(FileInfo *file, TranslationTableHeader **table,  		case CTO_SeqAfterExpression: 			if (!getRuleCharsText(file, &ruleChars)) return 0; 			for ((*table)->seqAfterExpressionLength = 0; 					(*table)->seqAfterExpressionLength < ruleChars.length; 					(*table)->seqAfterExpressionLength++) 				(*table)->seqAfterExpression[(*table)->seqAfterExpressionLength] = 						ruleChars.chars[(*table)->seqAfterExpressionLength]; 			(*table)->seqAfterExpression[(*table)->seqAfterExpressionLength] = 0; 			return 1;  		case CTO_CapsModeChars:

Fixed version (after fix):
 compileRule(FileInfo *file, TranslationTableHeader **table,  		case CTO_SeqAfterExpression: 			if (!getRuleCharsText(file, &ruleChars)) return 0; 			if ((ruleChars.length + 1) > SEQPATTERNSIZE) { 				compileError(file, "More than %d characters", SEQPATTERNSIZE); 				return 0; 			} 			for (int k = 0; k < ruleChars.length; k++) 				(*table)->seqAfterExpression[k] = ruleChars.chars[k]; 			(*table)->seqAfterExpression[ruleChars.length] = 0; 			(*table)->seqAfterExpressionLength = ruleChars.length; 			return 1;  		case CTO_CapsModeChars:

Patch:
patch: @@ -3736,12 +3736,14 @@ compileRule(FileInfo *file, TranslationTableHeader **table,
 
 		case CTO_SeqAfterExpression:
 			if (!getRuleCharsText(file, &ruleChars)) return 0;
-			for ((*table)->seqAfterExpressionLength = 0;
-					(*table)->seqAfterExpressionLength < ruleChars.length;
-					(*table)->seqAfterExpressionLength++)
-				(*table)->seqAfterExpression[(*table)->seqAfterExpressionLength] =
-						ruleChars.chars[(*table)->seqAfterExpressionLength];
-			(*table)->seqAfterExpression[(*table)->seqAfterExpressionLength] = 0;
+			if ((ruleChars.length + 1) > SEQPATTERNSIZE) {
+				compileError(file, "More than %d characters", SEQPATTERNSIZE);
+				return 0;
+			}
+			for (int k = 0; k < ruleChars.length; k++)
+				(*table)->seqAfterExpression[k] = ruleChars.chars[k];
+			(*table)->seqAfterExpression[ruleChars.length] = 0;
+			(*table)->seqAfterExpressionLength = ruleChars.length;
 			return 1;
 
 		case CTO_CapsModeChars:
path: liblouis/compileTranslationTable.c
Vulnerability: In libjpeg 1.63, there is a NULL pointer dereference in LineBuffer::FetchRegion in linebuffer.cpp.
Vulnerability ID: CVE-2022-32202
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/thorfdbg/libjpeg
Published: 2022-06-02
File: control/linebitmaprequester.cpp
Commit message: Fixed a NULL-pointer access in the line-based reconstruction process
in case no valid scan was found and no data is present.
Commit author: Thomas Richter

Vulnerable version (before fix):
 ** This class pulls blocks from the frame and reconstructs from those ** quantized block lines or encodes from them. ** ** $Id: linebitmaprequester.cpp,v 1.36 2021/07/22 13:18:36 thor Exp $ ** */  void LineBitmapRequester::ReconstructRegion(const RectAngle<LONG> &orgregion,con           LONG *dst = m_ppCTemp[i];           if (i >= rr->rr_usFirstComponent && i <= rr->rr_usLastComponent) {             ExtractBitmap(m_ppTempIBM[i],r,i);             FetchRegion(x,*m_pppImage[i],dst);           } else {             memset(dst,0,sizeof(LONG) * 64);           }

Fixed version (after fix):
 ** This class pulls blocks from the frame and reconstructs from those ** quantized block lines or encodes from them. ** ** $Id: linebitmaprequester.cpp,v 1.37 2022/05/31 10:16:52 thor Exp $ ** */  void LineBitmapRequester::ReconstructRegion(const RectAngle<LONG> &orgregion,con           LONG *dst = m_ppCTemp[i];           if (i >= rr->rr_usFirstComponent && i <= rr->rr_usLastComponent) {             ExtractBitmap(m_ppTempIBM[i],r,i);             if (*m_pppImage[i]) {               FetchRegion(x,*m_pppImage[i],dst);             } else {               memset(dst,0,sizeof(LONG) * 64);             }           } else {             memset(dst,0,sizeof(LONG) * 64);           }

Patch:
patch: @@ -43,7 +43,7 @@
 ** This class pulls blocks from the frame and reconstructs from those
 ** quantized block lines or encodes from them.
 **
-** $Id: linebitmaprequester.cpp,v 1.36 2021/07/22 13:18:36 thor Exp $
+** $Id: linebitmaprequester.cpp,v 1.37 2022/05/31 10:16:52 thor Exp $
 **
 */
 
@@ -562,7 +562,11 @@ void LineBitmapRequester::ReconstructRegion(const RectAngle<LONG> &orgregion,con
           LONG *dst = m_ppCTemp[i];
           if (i >= rr->rr_usFirstComponent && i <= rr->rr_usLastComponent) {
             ExtractBitmap(m_ppTempIBM[i],r,i);
-            FetchRegion(x,*m_pppImage[i],dst);
+            if (*m_pppImage[i]) {
+              FetchRegion(x,*m_pppImage[i],dst);
+            } else {
+              memset(dst,0,sizeof(LONG) * 64);
+            }
           } else {
             memset(dst,0,sizeof(LONG) * 64);
           }
path: control/linebitmaprequester.cpp
Vulnerability: Redis v7.0 was discovered to contain a memory leak via the component streamGetEdgeID.
Vulnerability ID: CVE-2022-33105
CWE: CWE-401
Severity score: 2.9
Project: https://github.com/redis/redis
Published: 2022-06-23
File: src/t_stream.c
Commit message: Fix memory leak in streamGetEdgeID (#10753)

si is initialized by streamIteratorStart(), we should call
streamIteratorStop() on it when done.

regression introduced in #9127 (redis 7.0)
Commit author: Yuuoniy

Vulnerable version (before fix):
 void streamGetEdgeID(stream *s, int first, int skip_tombstones, streamID *edge_i         streamID min_id = {0, 0}, max_id = {UINT64_MAX, UINT64_MAX};         *edge_id = first ? max_id : min_id;     }  }  /* Adds a new item into the stream 's' having the specified number of

Fixed version (after fix):
 void streamGetEdgeID(stream *s, int first, int skip_tombstones, streamID *edge_i         streamID min_id = {0, 0}, max_id = {UINT64_MAX, UINT64_MAX};         *edge_id = first ? max_id : min_id;     }     streamIteratorStop(&si); }  /* Adds a new item into the stream 's' having the specified number of

Patch:
patch: @@ -401,7 +401,7 @@ void streamGetEdgeID(stream *s, int first, int skip_tombstones, streamID *edge_i
         streamID min_id = {0, 0}, max_id = {UINT64_MAX, UINT64_MAX};
         *edge_id = first ? max_id : min_id;
     }
-
+    streamIteratorStop(&si);
 }
 
 /* Adds a new item into the stream 's' having the specified number of
path: src/t_stream.c
Vulnerability: Benjamin BALET Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at application/controllers/Leaves.php.
Vulnerability ID: CVE-2022-34133
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/bbalet/jorani
Published: 2022-06-28
File: application/controllers/Leaves.php
Commit message: BF:Persistent XSS fix #369
Commit author: Benjamin BALET

Vulnerable version (before fix):
 public function createComment($id, $source = "leaves/leaves"){       $newComment = new stdClass;       $newComment->type = "comment";       $newComment->author = $this->session->userdata('id');       $newComment->value = $this->input->post('comment');       $newComment->date = date("Y-n-j");       if ($oldComment != NULL){         array_push($oldComment->comments, $newComment);

Fixed version (after fix):
 public function createComment($id, $source = "leaves/leaves"){       $newComment = new stdClass;       $newComment->type = "comment";       $newComment->author = $this->session->userdata('id');       $newComment->value = $this->input->post('comment', TRUE);       $newComment->date = date("Y-n-j");       if ($oldComment != NULL){         array_push($oldComment->comments, $newComment);

Patch:
patch: @@ -182,7 +182,7 @@ public function createComment($id, $source = "leaves/leaves"){
       $newComment = new stdClass;
       $newComment->type = "comment";
       $newComment->author = $this->session->userdata('id');
-      $newComment->value = $this->input->post('comment');
+      $newComment->value = $this->input->post('comment', TRUE);
       $newComment->date = date("Y-n-j");
       if ($oldComment != NULL){
         array_push($oldComment->comments, $newComment);
path: application/controllers/Leaves.php
Vulnerability: There is a heap-based buffer over-read in libdwarf 0.4.0. This issue is related to dwarf_global_formref_b.
Vulnerability ID: CVE-2022-34299
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/davea42/libdwarf-code
Published: 2022-06-23
File: src/lib/libdwarf/dwarf_form.c
Commit message: Fixes old bug(which could result in Denial of Service)
due to a missing check before reading the 8 bytes of a DW_FORM_ref_sig8.
DW202206-001
	modified:   src/lib/libdwarf/dwarf_form.c
Commit author: David Anderson

Vulnerable version (before fix):
 find_sig8_target_as_global_offset(Dwarf_Attribute attr,     Dwarf_Bool targ_is_info = 0;     Dwarf_Off  localoff = 0;     int res = 0;      targ_is_info = attr->ar_cu_context->cc_is_info;     memcpy(sig8,attr->ar_debug_ptr,sizeof(*sig8));     res = dwarf_find_die_given_sig8(attr->ar_dbg, dwarf_global_formref_b(Dwarf_Attribute attr,         Dwarf_Bool t_is_info = TRUE;         Dwarf_Unsigned t_offset = 0;          memcpy(&sig8,attr->ar_debug_ptr,sizeof(Dwarf_Sig8));         res = find_sig8_target_as_global_offset(attr,             &sig8,&t_is_info,&t_offset,error);

Fixed version (after fix):
 find_sig8_target_as_global_offset(Dwarf_Attribute attr,     Dwarf_Bool targ_is_info = 0;     Dwarf_Off  localoff = 0;     int res = 0;     targ_is_info = attr->ar_cu_context->cc_is_info;     memcpy(sig8,attr->ar_debug_ptr,sizeof(*sig8));     res = dwarf_find_die_given_sig8(attr->ar_dbg, dwarf_global_formref_b(Dwarf_Attribute attr,         Dwarf_Bool t_is_info = TRUE;         Dwarf_Unsigned t_offset = 0;          if ((attr->ar_debug_ptr + sizeof(Dwarf_Sig8)) > section_end) {             _dwarf_error_string(dbg, error,                 DW_DLE_REF_SIG8_NOT_HANDLED,                 "DW_DLE_REF_SIG8_NOT_HANDLED: "                 " Dwarf_Sig8 content runs off the end of its section");             return DW_DLV_ERROR;         }         memcpy(&sig8,attr->ar_debug_ptr,sizeof(Dwarf_Sig8));         res = find_sig8_target_as_global_offset(attr,             &sig8,&t_is_info,&t_offset,error);

Patch:
patch: @@ -605,7 +605,6 @@ find_sig8_target_as_global_offset(Dwarf_Attribute attr,
     Dwarf_Bool targ_is_info = 0;
     Dwarf_Off  localoff = 0;
     int res = 0;
-
     targ_is_info = attr->ar_cu_context->cc_is_info;
     memcpy(sig8,attr->ar_debug_ptr,sizeof(*sig8));
     res = dwarf_find_die_given_sig8(attr->ar_dbg,
@@ -837,6 +836,13 @@ dwarf_global_formref_b(Dwarf_Attribute attr,
         Dwarf_Bool t_is_info = TRUE;
         Dwarf_Unsigned t_offset = 0;
 
+        if ((attr->ar_debug_ptr + sizeof(Dwarf_Sig8)) > section_end) {
+            _dwarf_error_string(dbg, error,
+                DW_DLE_REF_SIG8_NOT_HANDLED,
+                "DW_DLE_REF_SIG8_NOT_HANDLED: "
+                " Dwarf_Sig8 content runs off the end of its section");
+            return DW_DLV_ERROR;
+        }
         memcpy(&sig8,attr->ar_debug_ptr,sizeof(Dwarf_Sig8));
         res = find_sig8_target_as_global_offset(attr,
             &sig8,&t_is_info,&t_offset,error);
path: src/lib/libdwarf/dwarf_form.c
Vulnerability: rpmsg_virtio_add_ctrl_dev in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.
Vulnerability ID: CVE-2022-34494
CWE: CWE-415
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2022-06-26
File: drivers/rpmsg/virtio_rpmsg_bus.c
Commit message: rpmsg: virtio: Fix possible double free in rpmsg_virtio_add_ctrl_dev()

vch will be free in virtio_rpmsg_release_device() when
rpmsg_ctrldev_register_device() fails. There is no need to call
kfree() again.

Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Tested-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Link: https://lore.kernel.org/r/20220426060536.15594-3-hbh25y@gmail.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Commit author: Hangyu Hua

Vulnerable version (before fix):
 static struct rpmsg_device *rpmsg_virtio_add_ctrl_dev(struct virtio_device *vdev  	err = rpmsg_ctrldev_register_device(rpdev_ctrl); 	if (err) { 		kfree(vch); 		return ERR_PTR(err); 	} 

Fixed version (after fix):
 static struct rpmsg_device *rpmsg_virtio_add_ctrl_dev(struct virtio_device *vdev  	err = rpmsg_ctrldev_register_device(rpdev_ctrl); 	if (err) { 		/* vch will be free in virtio_rpmsg_release_device() */ 		return ERR_PTR(err); 	} 

Patch:
patch: @@ -851,7 +851,7 @@ static struct rpmsg_device *rpmsg_virtio_add_ctrl_dev(struct virtio_device *vdev
 
 	err = rpmsg_ctrldev_register_device(rpdev_ctrl);
 	if (err) {
-		kfree(vch);
+		/* vch will be free in virtio_rpmsg_release_device() */
 		return ERR_PTR(err);
 	}
path: drivers/rpmsg/virtio_rpmsg_bus.c
Vulnerability: rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.
Vulnerability ID: CVE-2022-34495
CWE: CWE-415
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2022-06-26
File: drivers/rpmsg/virtio_rpmsg_bus.c
Commit message: rpmsg: virtio: Fix possible double free in rpmsg_probe()

vch will be free in virtio_rpmsg_release_device() when
rpmsg_ns_register_device() fails. There is no need to call kfree() again.

Fix this by changing error path from free_vch to free_ctrldev.

Fixes: c486682ae1e2 ("rpmsg: virtio: Register the rpmsg_char device")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Tested-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Link: https://lore.kernel.org/r/20220426060536.15594-2-hbh25y@gmail.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Commit author: Hangyu Hua

Vulnerable version (before fix):
 static int rpmsg_probe(struct virtio_device *vdev)  		err = rpmsg_ns_register_device(rpdev_ns); 		if (err) 			goto free_vch; 	}  	/* static int rpmsg_probe(struct virtio_device *vdev)  	return 0;  free_vch: 	kfree(vch); free_ctrldev: 	rpmsg_virtio_del_ctrl_dev(rpdev_ctrl); free_coherent:

Fixed version (after fix):
 static int rpmsg_probe(struct virtio_device *vdev)  		err = rpmsg_ns_register_device(rpdev_ns); 		if (err) 			/* vch will be free in virtio_rpmsg_release_device() */ 			goto free_ctrldev; 	}  	/* static int rpmsg_probe(struct virtio_device *vdev)  	return 0;  free_ctrldev: 	rpmsg_virtio_del_ctrl_dev(rpdev_ctrl); free_coherent:

Patch:
patch: @@ -973,7 +973,8 @@ static int rpmsg_probe(struct virtio_device *vdev)
 
 		err = rpmsg_ns_register_device(rpdev_ns);
 		if (err)
-			goto free_vch;
+			/* vch will be free in virtio_rpmsg_release_device() */
+			goto free_ctrldev;
 	}
 
 	/*
@@ -997,8 +998,6 @@ static int rpmsg_probe(struct virtio_device *vdev)
 
 	return 0;
 
-free_vch:
-	kfree(vch);
 free_ctrldev:
 	rpmsg_virtio_del_ctrl_dev(rpdev_ctrl);
 free_coherent:
path: drivers/rpmsg/virtio_rpmsg_bus.c