Skip to contentSkip to conversation

tpm: tpm_nsc: Fix a double free of pdev in cleanup_nsc

PATCH In review Axel Lin 2 participants 2 messages Aug 3, 2011 – Aug 5, 2011 TPM device driver

lore
Share & tools
lore

Axel Lin

author
#0 lore raw

PATCH 1/1 tpm: tpm_nsc: Fix a double free of pdev in cleanup_nsc

platform_device_unregister() will release all resources and remove it from the subsystem, then drop reference count by calling platform_device_put().

We should not call kfree(pdev) after platform_device_unregister(pdev).

---
 drivers/char/tpm/tpm_nsc.c |    2 --
 1 files changed, 0 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_nsc.c +0 -2
index 82facc9..4d24648 100644
@@ -396,8 +396,6 @@ static void __exit cleanup_nsc(void)
 	if (pdev) {
 		tpm_nsc_remove(&pdev->dev);
 		platform_device_unregister(pdev);
-		kfree(pdev);
-		pdev = NULL;
 	}
 
 	platform_driver_unregister(&nsc_drv);
Signature · 1 line
1.7.4.1
#1 lore raw
Quoted 3 lines · Axel Lin

platform_device_unregister() will release all resources and remove it from the subsystem, then drop reference count by calling platform_device_put().

I also changed code into that direction in the recent patch to the tpm_nsc driver. I didn't know whether that memory had to be freed or not. Looking at several other drivers I found that none was freeing it but calling platform_device_put() (which is also called by platform_device_unregiser()) with the memory previously allocated via platform_device_alloc(). Though platform_device_put() calls put_device()

http://lxr.linux.no/#linux+v3.0/drivers/base/platform.c#L138

which in turn calls kobject_put().

http://lxr.linux.no/#linux+v3.0/drivers/base/core.c#L1066

It was not clear to me whether the pdev memory would actually get freed by kobject_put() -- but since other drivers were not freeing it explicitly I wasn't sure. So either many drivers have a memory leak or tpm_nsc was previously right about freeing it...

Stefan

Quoted 20 lines

We should not call kfree(pdev) after platform_device_unregister(pdev).

---
  drivers/char/tpm/tpm_nsc.c |    2 --
  1 files changed, 0 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_nsc.c +0 -2
index 82facc9..4d24648 100644
@@ -396,8 +396,6 @@ static void __exit cleanup_nsc(void)
  	if (pdev) {
  		tpm_nsc_remove(&pdev->dev);
  		platform_device_unregister(pdev);
-		kfree(pdev);
-		pdev = NULL;
  	}
 
  	platform_driver_unregister(&nsc_drv);