From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757151AbbGTXC6 (ORCPT ); Mon, 20 Jul 2015 19:02:58 -0400 Received: from mail-pd0-f175.google.com ([209.85.192.175]:33334 "EHLO mail-pd0-f175.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756862AbbGTXC5 (ORCPT ); Mon, 20 Jul 2015 19:02:57 -0400 From: Dmitry Torokhov To: Alessandro Zummo , Alexandre Belloni Cc: rtc-linux@googlegroups.com, linux-kernel@vger.kernel.org, Vasiliy Kulikov Subject: [PATCH 1/4] RTC: fix double free in rtc_register_device() error path Date: Mon, 20 Jul 2015 16:02:49 -0700 Message-Id: <1437433372-15425-1-git-send-email-dmitry.torokhov@gmail.com> X-Mailer: git-send-email 2.4.3.573.g4eafbef Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit 59cca865f21e9e7beab73fcf79ba4eb776a4c228 correctly noted that naked kfree() should not be used after failed device_register() call, however, while it added the needed put_device() it forgot to remove the original kfree() causing double-free. Cc: Vasiliy Kulikov Signed-off-by: Dmitry Torokhov --- drivers/rtc/class.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c index ea2a315..eb82ec2 100644 --- a/drivers/rtc/class.c +++ b/drivers/rtc/class.c @@ -234,8 +234,9 @@ struct rtc_device *rtc_device_register(const char *name, struct device *dev, err = device_register(&rtc->dev); if (err) { + /* This will free both memory and the ID */ put_device(&rtc->dev); - goto exit_kfree; + goto exit; } rtc_dev_add_device(rtc); @@ -247,9 +248,6 @@ struct rtc_device *rtc_device_register(const char *name, struct device *dev, return rtc; -exit_kfree: - kfree(rtc); - exit_ida: ida_simple_remove(&rtc_ida, id); -- 2.4.3.573.g4eafbef