From: Oscar Salvador <osalvador@suse.de>
To: Donet Tom <donettom@linux.ibm.com>
Cc: akpm@linux-foundation.org, clm@meta.com,
Jonathan.Cameron@huawei.com, alison.schofield@intel.com,
dakr@kernel.org, dave.jiang@intel.com, david@redhat.com,
gregkh@linuxfoundation.org, kamezawa.hiroyu@jp.fujitsu.com,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
rafael@kernel.org, ritesh.list@gmail.com, yury.norov@gmail.com,
ziy@nvidia.com
Subject: Re: [PATCH] drivers/base/node: Fix double free in register_one_node()
Date: Thu, 18 Sep 2025 15:29:55 +0200 [thread overview]
Message-ID: <aMwJU37LhxCUO6pZ@localhost.localdomain> (raw)
In-Reply-To: <20250918054144.58980-1-donettom@linux.ibm.com>
On Thu, Sep 18, 2025 at 11:11:44AM +0530, Donet Tom wrote:
> When device_register() fails in register_node(), it calls
> put_device(&node->dev). This triggers node_device_release(),
> which calls kfree(to_node(dev)), thereby freeing the entire
> node structure.
>
> As a result, when register_node() returns an error, the node
> memory has already been freed. Calling kfree(node) again in
> register_one_node() leads to a double free.
>
> This patch removes the redundant kfree(node) from
> register_one_node() to prevent the double free.
>
> Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
> Signed-off-by: Donet Tom <donettom@linux.ibm.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
--
Oscar Salvador
SUSE Labs
prev parent reply other threads:[~2025-09-18 13:30 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-18 5:41 [PATCH] drivers/base/node: Fix double free in register_one_node() Donet Tom
2025-09-18 5:55 ` David Hildenbrand
2025-09-18 5:56 ` David Hildenbrand
2025-09-18 6:45 ` Donet Tom
2025-09-18 13:28 ` Oscar Salvador
2025-09-18 13:29 ` Oscar Salvador [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aMwJU37LhxCUO6pZ@localhost.localdomain \
--to=osalvador@suse.de \
--cc=Jonathan.Cameron@huawei.com \
--cc=akpm@linux-foundation.org \
--cc=alison.schofield@intel.com \
--cc=clm@meta.com \
--cc=dakr@kernel.org \
--cc=dave.jiang@intel.com \
--cc=david@redhat.com \
--cc=donettom@linux.ibm.com \
--cc=gregkh@linuxfoundation.org \
--cc=kamezawa.hiroyu@jp.fujitsu.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=rafael@kernel.org \
--cc=ritesh.list@gmail.com \
--cc=yury.norov@gmail.com \
--cc=ziy@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.