Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S376761AbdD2Qpi (ORCPT ); Sat, 29 Apr 2017 12:45:38 -0400 Received: from forward4m.cmail.yandex.net ([5.255.216.22]:58783 "EHLO forward4m.cmail.yandex.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S376726AbdD2Qp2 (ORCPT ); Sat, 29 Apr 2017 12:45:28 -0400 X-Greylist: delayed 423 seconds by postgrey-1.27 at vger.kernel.org; Sat, 29 Apr 2017 12:45:28 EDT Authentication-Results: mxback9j.mail.yandex.net; dkim=pass header.i=@yandex.ru From: Evgeniy Polyakov Envelope-From: drustafa@yandex.ru To: Alexey Ignatov , "linux-kernel@vger.kernel.org" In-Reply-To: <20170325170645.16073-1-lexszero@gmail.com> References: <20170325170645.16073-1-lexszero@gmail.com> Subject: Re: [PATCH] w1: w1-gpio: Fix double-free of platform_data MIME-Version: 1.0 Message-Id: <5485571493483903@web21g.yandex.ru> X-Mailer: Yamail [ http://yandex.ru ] 5.0 Date: Sat, 29 Apr 2017 19:38:23 +0300 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=utf-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 883 Lines: 25 Hi Alexey 25.03.2017, 20:08, "Alexey Ignatov" : > struct w1_gpio_platform_data was allocated using devres when using > device tree. Then it was assigned to dev.platform_data, which leaded > to double free on device removal by devres and by direct > kfree(platform_data) in platform_device_release) If this patch is still relevant, please add someone from device-tree into copy, I would think this bug affect anyone and we see alot of bug reports since probe failure ends up with double free. Also a nit: > @@ -143,12 +141,12 @@ static int w1_gpio_probe(struct platform_device *pdev) >          int err; > >          if (of_have_populated_dt()) { > - err = w1_gpio_probe_dt(pdev); > - if (err < 0) > - return err; > + pdata = w1_gpio_probe_dt(pdev); > + if (IS_ERR(pdata) < 0) > + return PTR_ERR(pdata); IS_ERR() should not be used this way