[PATCH 6.1.y 5.15.y 5.10.y] driver core: bus: Fix double free in driver API bus_register()

[PATCH 6.1.y 5.15.y 5.10.y] driver core: bus: Fix double free in driver API bus_register()

[Tomas Krcka]

From: Zijun Hu <quic_zijuhu@quicinc.com>

[ Upstream commit bfa54a793ba77ef696755b66f3ac4ed00c7d1248 ]

For bus_register(), any error which happens after kset_register() will
cause that @priv are freed twice, fixed by setting @priv with NULL after
the first free.

Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Link: https://lore.kernel.org/r/20240727-bus_register_fix-v1-1-fed8dd0dba7a@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Tomas Krcka <krckatom@amazon.de>
---
 drivers/base/bus.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index 339a9edcde5f..8fae7c700cc9 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -853,6 +853,8 @@ int bus_register(struct bus_type *bus)
 	bus_remove_file(bus, &bus_attr_uevent);
 bus_uevent_fail:
 	kset_unregister(&bus->p->subsys);
+	/* Above kset_unregister() will kfree @priv */
+	priv = NULL;
 out:
 	kfree(bus->p);
 	bus->p = NULL;
-- 
2.40.1

Re: [PATCH 6.1.y 5.15.y 5.10.y] driver core: bus: Fix double free in driver API bus_register()

[Krcka, Tomas]

It’s not correct patch - you can discarded.
Sorry for noise.
Tomas

> On 25. Oct 2024, at 15:45, Tomas Krcka <tomas.krcka@gmail.com> wrote:
> 
> CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.
> 
> 
> 
> From: Zijun Hu <quic_zijuhu@quicinc.com>
> 
> [ Upstream commit bfa54a793ba77ef696755b66f3ac4ed00c7d1248 ]
> 
> For bus_register(), any error which happens after kset_register() will
> cause that @priv are freed twice, fixed by setting @priv with NULL after
> the first free.
> 
> Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
> Link: https://lore.kernel.org/r/20240727-bus_register_fix-v1-1-fed8dd0dba7a@quicinc.com
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Tomas Krcka <krckatom@amazon.de>
> ---
> drivers/base/bus.c | 2 ++
> 1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/base/bus.c b/drivers/base/bus.c
> index 339a9edcde5f..8fae7c700cc9 100644
> --- a/drivers/base/bus.c
> +++ b/drivers/base/bus.c
> @@ -853,6 +853,8 @@ int bus_register(struct bus_type *bus)
>        bus_remove_file(bus, &bus_attr_uevent);
> bus_uevent_fail:
>        kset_unregister(&bus->p->subsys);
> +       /* Above kset_unregister() will kfree @priv */
> +       priv = NULL;
> out:
>        kfree(bus->p);
>        bus->p = NULL;
> --
> 2.40.1
> 




Amazon Web Services Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 257764 B
Sitz: Berlin
Ust-ID: DE 365 538 597