Re: [PATCH v4] uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory

Greg Kroah-Hartman
2026-04-02T13:52:11Z

On Thu, Feb 26, 2026 at 11:32:50PM +0800, Guangshuo Li wrote:
> uio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in
> probe(), but then calls kfree(udev) both on the probe() error path
> (label out_free) and again in remove().
>
> Because devm_kzalloc() allocations are devres-managed and are freed
> automatically when the device is detached (including after a failing
> probe() and during driver unbind), the explicit kfree() can lead to a
> double free.
>
> If probe() fails after devm_kzalloc(), the error path frees udev and
> devres cleanup will free it again when the core unwinds the partially
> bound device. On normal driver removal, remove() frees udev and devres
> will free it again when the device is detached.
>
> This issue was identified by a static analysis tool I developed and
> confirmed by manual review. Fix by removing the manual kfree() calls
> and dropping the now-unused label.
>
> Fixes: 3397c3cd859a2 ("uio: Add SVA support for PCI devices via uio_pci_generic_sva.c")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
> v4:
> - Add description of how the issue was found and tested.
>
> v3:
> - Add changelog below the --- line describing changes since v2.
>
> v2:
> - Reflow commit message to keep lines within 75 characters.
>
> drivers/uio/uio_pci_generic_sva.c | 5 +----
> 1 file changed, 1 insertion(+), 4 deletions(-)
>
> diff --git a/drivers/uio/uio_pci_generic_sva.c b/drivers/uio/uio_pci_generic_sva.c
> index 4a46acd994a8..152201047334 100644
> --- a/drivers/uio/uio_pci_generic_sva.c
> +++ b/drivers/uio/uio_pci_generic_sva.c
> @@ -129,15 +129,13 @@ static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
> ret = devm_uio_register_device(&pdev->dev, &udev->info);
> if (ret) {
> dev_err(&pdev->dev, "Failed to register uio device\n");
> - goto out_free;
> + goto out_disable;
> }
>
> pci_set_drvdata(pdev, udev);
>
> return 0;
>
> -out_free:
> - kfree(udev);
> out_disable:
> pci_disable_device(pdev);
>
> @@ -150,7 +148,6 @@ static void remove(struct pci_dev *pdev)
>
> pci_release_regions(pdev);
> pci_disable_device(pdev);
> - kfree(udev);
> }
>
> static ssize_t pasid_show(struct device *dev,
> --
> 2.43.0
>

Breaks the build, how did you test this:
CC [M] drivers/uio/uio_pci_generic_sva.o
drivers/uio/uio_pci_generic_sva.c:147:26: error: unused variable 'udev' [-Werror,-Wunused-variable]
147 | struct uio_pci_sva_dev *udev = pci_get_drvdata(pdev);
| ^~~~
1 error generated.

{sigh}