From patchwork Thu Apr 18 07:22:58 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pan Bian X-Patchwork-Id: 10906595 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 730F717E0 for ; Thu, 18 Apr 2019 07:23:47 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4E73F28720 for ; Thu, 18 Apr 2019 07:23:47 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4291028AA5; Thu, 18 Apr 2019 07:23:47 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id AE4A228720 for ; Thu, 18 Apr 2019 07:23:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=mkKXJZl7emGK5PNbHnNu1/SJ5SdL28PgtKqwjRgfn/g=; b=e3Y lzNK6eiw1SjdzDPXNMdKlnGtbDhrTB0EikooHpJbnz1id9oiqMy1aJ24Nmv0do1JKsIOEoXGkawoS I4j+u1rfAGqQc23hLgIc18JQJMAU4QJWVWUhZLnYhulELL+P/mPiW7enlR27uQ+TnuojhpDi0nyrZ hAF4SFgCYVZAK+2f97xWyEiZukIEmUPQHPdS4AhNvMDu8AXLwwkq+YVYLiJ6TN/MfV06AI8ybg2/C X693F54mYVuvfvXAFbF06jGRYuKZ3hGktN0o1KwUiMR1vIIRhnOKx6t/g4jVWsN/JJtvp9RFsH48B whibpMUo4aNoufJQxPQkLsMEE7W7f3w==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1hH1OY-0001tb-Vd; Thu, 18 Apr 2019 07:23:42 +0000 Received: from m50-132.163.com ([123.125.50.132]) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1hH1OV-0001sr-K9 for linux-arm-kernel@lists.infradead.org; Thu, 18 Apr 2019 07:23:42 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id; bh=A2avxIEXMxtUFGqdlf UaJw2dGK5fmozKEPD9FwObH70=; b=Q1sf1Rhku4O9XOBto8Sjj0Gd2pxHy4Z5AH nuo2LuqplfA64do2+Ibq9t0wNt4N8TZPUeQikn3BFBPAOVhIxiAj0N2i1Y/HL6+f oGkN/EyRZCWC4TToyPMKbadPhzUEESDh1isKIGJIMzCN0KaaLvnp93wPg7pG2Z9o 1ZlnOmXlU= Received: from bp.localdomain (unknown [218.106.182.174]) by smtp2 (Coremail) with SMTP id DNGowACniR_TJbhcX+MIAA--.174S3; Thu, 18 Apr 2019 15:23:06 +0800 (CST) From: Pan Bian To: Alexander Shishkin , Maxime Coquelin , Alexandre Torgue Subject: stm class: Fix possible double free Date: Thu, 18 Apr 2019 15:22:58 +0800 Message-Id: <1555572178-73786-1-git-send-email-bianpan2016@163.com> X-Mailer: git-send-email 2.7.4 X-CM-TRANSID: DNGowACniR_TJbhcX+MIAA--.174S3 X-Coremail-Antispam: 1Uf129KBjvJXoW7try3Cw4DAr1kCr1kKw1ftFb_yoW8GF43pa 18Ga4Yyry8Krsrur1DJF18ZFy5GayIkw1ruFy0kwna9FZ8Z34vyryYya45CayDJrW8AFWa qFW3ArW8ur1UAw7anT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07UlkskUUUUU= X-Originating-IP: [218.106.182.174] X-CM-SenderInfo: held01tdqsiiqw6rljoofrz/xtbBZBKaclQHEfe2+AAAsl X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190418_002340_438728_757B085E X-CRM114-Status: UNSURE ( 8.96 ) X-CRM114-Notice: Please train this message. X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Pan Bian , linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP The function stm_register_device() calls put_device(&stm->dev) to release allocated memory (in stm_device_release()) on error paths. However, after that, the freed memory stm is released again, resulting in a double free bug. There is a similar issue in the function stm_source_register_device. This patch fixes these issues. Signed-off-by: Pan Bian Reviewed-by: Mukesh Ojha --- drivers/hwtracing/stm/core.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c index c7ba8ac..cfb5c4d 100644 --- a/drivers/hwtracing/stm/core.c +++ b/drivers/hwtracing/stm/core.c @@ -886,8 +886,10 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data, return -ENOMEM; stm->major = register_chrdev(0, stm_data->name, &stm_fops); - if (stm->major < 0) - goto err_free; + if (stm->major < 0) { + vfree(stm); + return err; + } device_initialize(&stm->dev); stm->dev.devt = MKDEV(stm->major, 0); @@ -933,8 +935,6 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data, /* matches device_initialize() above */ put_device(&stm->dev); -err_free: - vfree(stm); return err; } @@ -1277,7 +1277,6 @@ int stm_source_register_device(struct device *parent, err: put_device(&src->dev); - kfree(src); return err; }