diff options
| author | Donet Tom <donettom@linux.ibm.com> | 2025-09-18 11:11:44 +0530 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-15 11:58:06 +0200 |
| commit | 53683b4d3740b0579147d46a34b24e2fb25d1a17 (patch) | |
| tree | 2a8a357735811e41d05225f575944b47f70154b6 | |
| parent | 7e76fe9dfadbc00364d7523d5a109e9d3e4a7db2 (diff) | |
| download | linux-53683b4d3740b0579147d46a34b24e2fb25d1a17.tar.gz linux-53683b4d3740b0579147d46a34b24e2fb25d1a17.tar.bz2 linux-53683b4d3740b0579147d46a34b24e2fb25d1a17.zip | |
drivers/base/node: fix double free in register_one_node()
[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]
When device_register() fails in register_node(), it calls
put_device(&node->dev). This triggers node_device_release(), which calls
kfree(to_node(dev)), thereby freeing the entire node structure.
As a result, when register_node() returns an error, the node memory has
already been freed. Calling kfree(node) again in register_one_node()
leads to a double free.
This patch removes the redundant kfree(node) from register_one_node() to
prevent the double free.
Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com
Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
Signed-off-by: Donet Tom <donettom@linux.ibm.com>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
Cc: Alison Schofield <alison.schofield@intel.com>
Cc: Chris Mason <clm@meta.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Hiroyouki Kamezawa <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Joanthan Cameron <Jonathan.Cameron@huawei.com>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Yury Norov (NVIDIA) <yury.norov@gmail.com>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/base/node.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/base/node.c b/drivers/base/node.c index 7b2ff66c119a..47960a34305d 100644 --- a/drivers/base/node.c +++ b/drivers/base/node.c @@ -880,7 +880,6 @@ int __register_one_node(int nid) error = register_node(node_devices[nid], nid); if (error) { node_devices[nid] = NULL; - kfree(node); return error; } |