[PATCH] devcoredump: fix double free on device registration failure

[PATCH] devcoredump: fix double free on device registration failure

[Johan Hovold]

The device coredump class release function devcd_dev_release() puts the
module reference and frees the data so just return after dropping the
device reference on registration failures to avoid a module reference
imbalance and double free.

This issue was flagged by an LLM.

Fixes: 833c95456a70 ("device coredump: add new device coredump class")
Cc: stable@vger.kernel.org	# 3.18
Cc: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/base/devcoredump.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/base/devcoredump.c b/drivers/base/devcoredump.c
index 8bb1763083dd..16e99ac926a7 100644
--- a/drivers/base/devcoredump.c
+++ b/drivers/base/devcoredump.c
@@ -433,10 +433,12 @@ void dev_coredumpm_timeout(struct device *dev, struct module *owner,
 	devcd->init_completed = true;
 	mutex_unlock(&devcd->mutex);
 	return;
+
  put_device:
 	mutex_unlock(&devcd->mutex);
 	cancel_delayed_work_sync(&devcd->del_wk);
 	put_device(&devcd->devcd_dev);
+	return;
 
  put_module:
 	module_put(owner);
-- 
2.55.0