[PATCH v2] uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory

[PATCH v2] uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory

[Guangshuo Li]

uio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in
probe(), but then calls kfree(udev) both on the probe() error path
(label out_free) and again in remove().

Because devm_kzalloc() allocations are devres-managed and are freed
automatically when the device is detached (including after a failing
probe() and during driver unbind), the explicit kfree() can lead to a
double free.

If probe() fails after devm_kzalloc(), the error path frees udev and
devres cleanup will free it again when the core unwinds the partially
bound device.  On normal driver removal, remove() frees udev and devres
will free it again when the device is detached.

Fix by removing the manual kfree() calls and dropping the now-unused
label.

Fixes: 3397c3cd859a2 ("uio: Add SVA support for PCI devices via uio_pci_generic_sva.c")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/uio/uio_pci_generic_sva.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/uio/uio_pci_generic_sva.c b/drivers/uio/uio_pci_generic_sva.c
index 4a46acd994a8..152201047334 100644
--- a/drivers/uio/uio_pci_generic_sva.c
+++ b/drivers/uio/uio_pci_generic_sva.c
@@ -129,15 +129,13 @@ static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	ret = devm_uio_register_device(&pdev->dev, &udev->info);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to register uio device\n");
-		goto out_free;
+		goto out_disable;
 	}
 
 	pci_set_drvdata(pdev, udev);
 
 	return 0;
 
-out_free:
-	kfree(udev);
 out_disable:
 	pci_disable_device(pdev);
 
@@ -150,7 +148,6 @@ static void remove(struct pci_dev *pdev)
 
 	pci_release_regions(pdev);
 	pci_disable_device(pdev);
-	kfree(udev);
 }
 
 static ssize_t pasid_show(struct device *dev,
-- 
2.43.0

Re: [PATCH v2] uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory

[Greg Kroah-Hartman]

On Wed, Feb 25, 2026 at 10:51:31PM +0800, Guangshuo Li wrote:
> uio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in
> probe(), but then calls kfree(udev) both on the probe() error path
> (label out_free) and again in remove().
> 
> Because devm_kzalloc() allocations are devres-managed and are freed
> automatically when the device is detached (including after a failing
> probe() and during driver unbind), the explicit kfree() can lead to a
> double free.
> 
> If probe() fails after devm_kzalloc(), the error path frees udev and
> devres cleanup will free it again when the core unwinds the partially
> bound device.  On normal driver removal, remove() frees udev and devres
> will free it again when the device is detached.
> 
> Fix by removing the manual kfree() calls and dropping the now-unused
> label.
> 
> Fixes: 3397c3cd859a2 ("uio: Add SVA support for PCI devices via uio_pci_generic_sva.c")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/uio/uio_pci_generic_sva.c | 5 +----
>  1 file changed, 1 insertion(+), 4 deletions(-)
> 
> diff --git a/drivers/uio/uio_pci_generic_sva.c b/drivers/uio/uio_pci_generic_sva.c
> index 4a46acd994a8..152201047334 100644
> --- a/drivers/uio/uio_pci_generic_sva.c
> +++ b/drivers/uio/uio_pci_generic_sva.c
> @@ -129,15 +129,13 @@ static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  	ret = devm_uio_register_device(&pdev->dev, &udev->info);
>  	if (ret) {
>  		dev_err(&pdev->dev, "Failed to register uio device\n");
> -		goto out_free;
> +		goto out_disable;
>  	}
>  
>  	pci_set_drvdata(pdev, udev);
>  
>  	return 0;
>  
> -out_free:
> -	kfree(udev);
>  out_disable:
>  	pci_disable_device(pdev);
>  
> @@ -150,7 +148,6 @@ static void remove(struct pci_dev *pdev)
>  
>  	pci_release_regions(pdev);
>  	pci_disable_device(pdev);
> -	kfree(udev);
>  }
>  
>  static ssize_t pasid_show(struct device *dev,
> -- 
> 2.43.0
> 
> 

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- This looks like a new version of a previously submitted patch, but you
  did not list below the --- line any changes from the previous version.
  Please read the section entitled "The canonical patch format" in the
  kernel file, Documentation/process/submitting-patches.rst for what
  needs to be done here to properly describe this.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot