2022-04-19 15:19:06

by Hangyu Hua

Subject: [PATCH] hwtracing: stm: fix possible double free in stm_register_device()

put_device() will call stm_device_release() to free stm when
stm_register_device() fails. So there is no need to call vfree() again.

Fix this by adding a return after put_device().

Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices")
Signed-off-by: Hangyu Hua <[email protected]>
---
drivers/hwtracing/stm/core.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 2712e699ba08..403b4f41bb1b 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -915,6 +915,7 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data,

/* matches device_initialize() above */
put_device(&stm->dev);
+ return err;
err_free:
vfree(stm);

--
2.25.1

2022-05-05 09:26:08

by Hangyu Hua

Subject: Re: [PATCH] hwtracing: stm: fix possible double free in stm_register_device()

Ping

On 2022/4/18 16:16, Hangyu Hua wrote:
> put_device() will call stm_device_release() to free stm when
> stm_register_device() fails. So there is no need to call vfree() again.
>
> Fix this by adding a return after put_device().
>
> Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices")
> Signed-off-by: Hangyu Hua <[email protected]>
> ---
> drivers/hwtracing/stm/core.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
> index 2712e699ba08..403b4f41bb1b 100644
> --- a/drivers/hwtracing/stm/core.c
> +++ b/drivers/hwtracing/stm/core.c
> @@ -915,6 +915,7 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data,
>
> /* matches device_initialize() above */
> put_device(&stm->dev);
> + return err;
> err_free:
> vfree(stm);
>

2022-05-23 07:47:45

by Hangyu Hua

Subject: Re: [PATCH] hwtracing: stm: fix possible double free in stm_register_device()

Gentel ping.

On 2022/5/5 09:29, Hangyu Hua wrote:
> Ping
>
> On 2022/4/18 16:16, Hangyu Hua wrote:
>> put_device() will call stm_device_release() to free stm when
>> stm_register_device() fails. So there is no need to call vfree() again.
>>
>> Fix this by adding a return after put_device().
>>
>> Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System
>> Trace Module devices")
>> Signed-off-by: Hangyu Hua <[email protected]>
>> ---
>>   drivers/hwtracing/stm/core.c | 1 +
>>   1 file changed, 1 insertion(+)
>>
>> diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
>> index 2712e699ba08..403b4f41bb1b 100644
>> --- a/drivers/hwtracing/stm/core.c
>> +++ b/drivers/hwtracing/stm/core.c
>> @@ -915,6 +915,7 @@ int stm_register_device(struct device *parent,
>> struct stm_data *stm_data,
>>       /* matches device_initialize() above */
>>       put_device(&stm->dev);
>> +    return err;
>>   err_free:
>>       vfree(stm);

2022-06-23 01:53:27

by Hangyu Hua

Subject: Re: [PATCH] hwtracing: stm: fix possible double free in stm_register_device()

On 2022/5/23 09:55, Hangyu Hua wrote:
> Gentel ping.
>
> On 2022/5/5 09:29, Hangyu Hua wrote:
>> Ping
>>
>> On 2022/4/18 16:16, Hangyu Hua wrote:
>>> put_device() will call stm_device_release() to free stm when
>>> stm_register_device() fails. So there is no need to call vfree() again.
>>>
>>> Fix this by adding a return after put_device().
>>>
>>> Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System
>>> Trace Module devices")
>>> Signed-off-by: Hangyu Hua <[email protected]>
>>> ---
>>>   drivers/hwtracing/stm/core.c | 1 +
>>>   1 file changed, 1 insertion(+)
>>>
>>> diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
>>> index 2712e699ba08..403b4f41bb1b 100644
>>> --- a/drivers/hwtracing/stm/core.c
>>> +++ b/drivers/hwtracing/stm/core.c
>>> @@ -915,6 +915,7 @@ int stm_register_device(struct device *parent,
>>> struct stm_data *stm_data,
>>>       /* matches device_initialize() above */
>>>       put_device(&stm->dev);
>>> +    return err;
>>>   err_free:
>>>       vfree(stm);

Gentel ping.