driver core: bus: Fix double free in driver API bus_register()

PATCH New Hagar Hemdan 1 participant 1 message Feb 12, 2025 Stable branch

lore

Share & tools

lore

Hagar Hemdan

author

2025-02-12 08:58 UTC #0 lore raw

PATCH 1/1 driver core: bus: Fix double free in driver API bus_register()

From: Zijun Hu <[email protected]>

commit bfa54a793ba77ef696755b66f3ac4ed00c7d1248 upstream.

For bus_register(), any error which happens after kset_register() will cause that @priv are freed twice, fixed by setting @priv with NULL after the first free.

Signed-off-by Zijun Hu <[email protected]>

Link https://lore.kernel.org/r/[email protected] open here

[ hagar : required setting bus->p with NULL instead of priv]

Signed-off-by Hagar Hemdan <[email protected]>

---
 drivers/base/bus.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/base/bus.c +2 -0

index f970a40a2f7a..0b0969e64f5c 100644
@@ -873,6 +873,8 @@ int bus_register(struct bus_type *bus)
 	bus_remove_file(bus, &bus_attr_uevent);
 bus_uevent_fail:
 	kset_unregister(&bus->p->subsys);
+	/* Above kset_unregister() will kfree @bus->p */
+	bus->p = NULL;
 out:
 	kfree(bus->p);
 	bus->p = NULL;

Signature · 1 line

2.47.1