All of lore.kernel.org
 help / color / mirror / Atom feed
From: Donet Tom <donettom@linux.ibm.com>
To: akpm@linux-foundation.org, clm@meta.com
Cc: Jonathan.Cameron@huawei.com, alison.schofield@intel.com,
	dakr@kernel.org, dave.jiang@intel.com, david@redhat.com,
	gregkh@linuxfoundation.org, kamezawa.hiroyu@jp.fujitsu.com,
	linux-kernel@vger.kernel.org, linux-mm@kvack.org,
	osalvador@suse.de, rafael@kernel.org, ritesh.list@gmail.com,
	yury.norov@gmail.com, ziy@nvidia.com,
	Donet Tom <donettom@linux.ibm.com>
Subject: [PATCH] drivers/base/node: Fix double free in register_one_node()
Date: Thu, 18 Sep 2025 11:11:44 +0530	[thread overview]
Message-ID: <20250918054144.58980-1-donettom@linux.ibm.com> (raw)

When device_register() fails in register_node(), it calls
put_device(&node->dev). This triggers node_device_release(),
which calls kfree(to_node(dev)), thereby freeing the entire
node structure.

As a result, when register_node() returns an error, the node
memory has already been freed. Calling kfree(node) again in
register_one_node() leads to a double free.

This patch removes the redundant kfree(node) from
register_one_node() to prevent the double free.

Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
Signed-off-by: Donet Tom <donettom@linux.ibm.com>
---
 drivers/base/node.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/base/node.c b/drivers/base/node.c
index 1608816de67f..6b6e55a98b79 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -885,7 +885,6 @@ int register_one_node(int nid)
 	error = register_node(node_devices[nid], nid);
 	if (error) {
 		node_devices[nid] = NULL;
-		kfree(node);
 		return error;
 	}
 
-- 
2.51.0



             reply	other threads:[~2025-09-18  5:42 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-09-18  5:41 Donet Tom [this message]
2025-09-18  5:55 ` [PATCH] drivers/base/node: Fix double free in register_one_node() David Hildenbrand
2025-09-18  5:56   ` David Hildenbrand
2025-09-18  6:45   ` Donet Tom
2025-09-18 13:28   ` Oscar Salvador
2025-09-18 13:29 ` Oscar Salvador

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250918054144.58980-1-donettom@linux.ibm.com \
    --to=donettom@linux.ibm.com \
    --cc=Jonathan.Cameron@huawei.com \
    --cc=akpm@linux-foundation.org \
    --cc=alison.schofield@intel.com \
    --cc=clm@meta.com \
    --cc=dakr@kernel.org \
    --cc=dave.jiang@intel.com \
    --cc=david@redhat.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=kamezawa.hiroyu@jp.fujitsu.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=osalvador@suse.de \
    --cc=rafael@kernel.org \
    --cc=ritesh.list@gmail.com \
    --cc=yury.norov@gmail.com \
    --cc=ziy@nvidia.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.