Skip to content

Commit ba18ded

Browse files
Yongzhi LiuPaolo Abeni
authored andcommitted
net: pds_core: Fix possible double free in error handling path
When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), Callback function pdsc_auxbus_dev_release calls kfree(padev) to free memory. We shouldn't call kfree(padev) again in the error handling path. Fix this by cleaning up the redundant kfree() and putting the error handling back to where the errors happened. Fixes: 4569cce ("pds_core: add auxiliary_bus devices") Signed-off-by: Yongzhi Liu <hyperlyzcs@gmail.com> Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com> Reviewed-by: Shannon Nelson <shannon.nelson@amd.com> Link: https://lore.kernel.org/r/20240306105714.20597-1-hyperlyzcs@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
1 parent d5b8aff commit ba18ded

1 file changed

Lines changed: 4 additions & 8 deletions

File tree

  • drivers/net/ethernet/amd/pds_core

drivers/net/ethernet/amd/pds_core/auxbus.c

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -160,23 +160,19 @@ static struct pds_auxiliary_dev *pdsc_auxbus_dev_register(struct pdsc *cf,
160160
if (err < 0) {
161161
dev_warn(cf->dev, "auxiliary_device_init of %s failed: %pe\n",
162162
name, ERR_PTR(err));
163-
goto err_out;
163+
kfree(padev);
164+
return ERR_PTR(err);
164165
}
165166

166167
err = auxiliary_device_add(aux_dev);
167168
if (err) {
168169
dev_warn(cf->dev, "auxiliary_device_add of %s failed: %pe\n",
169170
name, ERR_PTR(err));
170-
goto err_out_uninit;
171+
auxiliary_device_uninit(aux_dev);
172+
return ERR_PTR(err);
171173
}
172174

173175
return padev;
174-
175-
err_out_uninit:
176-
auxiliary_device_uninit(aux_dev);
177-
err_out:
178-
kfree(padev);
179-
return ERR_PTR(err);
180176
}
181177

182178
int pdsc_auxbus_dev_del(struct pdsc *cf, struct pdsc *pf)

0 commit comments

Comments
 (0)