Skip to contentSkip to conversation

cdx: Fix double free when sysfs file creation fails

PATCH In review Prasanna Kumar T S M 2 participants 2 messages Jul 24 – Jul 28 AMD cdx bus driver

lore
Share & tools
lore

Prasanna Kumar T S M

author
#0 lore raw

PATCH v2 1/1 cdx: Fix double free when sysfs file creation fails

In cdx_create_res_attr(), if sysfs_create_bin_file() fails, the code frees res_attr but doesn't set cdx_dev->res_attr[num] to NULL. This leaves a dangling pointer in the array. Then cdx_destroy_res_attr() frees the already-freed memory. Fix the double free by initializing cdx_dev->res_attr[num] after sysfs_create_bin_file() completes.

Fixes aeda33ab8160 ("cdx: create sysfs bin files for cdx resources")
Cc [email protected]
Signed-off-by Prasanna Kumar T S M <[email protected]>
---
 drivers/cdx/cdx.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/cdx/cdx.c +5 -2
index d3d230247262..a118a89a7779 100644
@@ -738,7 +738,6 @@ static int cdx_create_res_attr(struct cdx_device *cdx_dev, int num)
 
 	sysfs_bin_attr_init(res_attr);
 
-	cdx_dev->res_attr[num] = res_attr;
 	sprintf(res_attr_name, "resource%d", num);
 
 	res_attr->mmap = cdx_mmap_resource;

@@ -747,8 +746,12 @@ static int cdx_create_res_attr(struct cdx_device *cdx_dev, int num)
 	res_attr->size = cdx_resource_len(cdx_dev, num);
 	res_attr->private = (void *)(unsigned long)num;
 	ret = sysfs_create_bin_file(&cdx_dev->dev.kobj, res_attr);
-	if (ret)
+	if (ret) {
 		kfree(res_attr);
+		return ret;
+	}
+
+	cdx_dev->res_attr[num] = res_attr;
 
 	return ret;
 }
Signature · 1 line
2.49.0
maintainer Acked-by on v2 1/1
#1 lore raw
Quoted 13 lines

-----Original Message-----
From: Prasanna Kumar T S M <[email protected]>
Sent: Friday, July 24, 2026 2:57 PM
To: Gupta, Nipun <[email protected]>; Agarwal, Nikhil <[email protected]>; [email protected]; Gupta, Puneet (DCG- ENG) <[email protected]>; Gangurde, Abhijit <[email protected]>; [email protected]; [email protected]
Cc: [email protected]
Subject: [PATCH v2] cdx: Fix double free when sysfs file creation fails

Quoted 8 lines

In cdx_create_res_attr(), if sysfs_create_bin_file() fails, the code frees res_attr but doesn't set cdx_dev->res_attr[num] to NULL. This leaves a dangling pointer in the array. Then cdx_destroy_res_attr() frees the already-freed memory. Fix the double free by initializing cdx_dev->res_attr[num] after sysfs_create_bin_file() completes.

Fixes aeda33ab8160 ("cdx: create sysfs bin files for cdx resources")
Cc [email protected]
Signed-off-by Prasanna Kumar T S M <[email protected]>
Acked-by Nikhil Agarwal <[email protected]>