Skip to content

Commit

Permalink
driver core: bus: Fix double free in driver API bus_register()
Browse files Browse the repository at this point in the history
For bus_register(), any error which happens after kset_register() will
cause that @priv are freed twice, fixed by setting @priv with NULL after
the first free.

Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Link: https://lore.kernel.org/r/20240727-bus_register_fix-v1-1-fed8dd0dba7a@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
zijun-hu authored and gregkh committed Jul 31, 2024
1 parent 2bdf3b8 commit bfa54a7
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions drivers/base/bus.c
Original file line number Diff line number Diff line change
Expand Up @@ -922,6 +922,8 @@ int bus_register(const struct bus_type *bus)
bus_remove_file(bus, &bus_attr_uevent);
bus_uevent_fail:
kset_unregister(&priv->subsys);
/* Above kset_unregister() will kfree @priv */
priv = NULL;
out:
kfree(priv);
return retval;
Expand Down

0 comments on commit bfa54a7

Please sign in to comment.