[PATCH v2] cdx: Fix double free when sysfs file creation fails

[PATCH v2] cdx: Fix double free when sysfs file creation fails

[Prasanna Kumar T S M]

In cdx_create_res_attr(), if sysfs_create_bin_file() fails, the code
frees res_attr but doesn't set cdx_dev->res_attr[num] to NULL. This
leaves a dangling pointer in the array. Then cdx_destroy_res_attr()
frees the already-freed memory. Fix the double free by initializing
cdx_dev->res_attr[num] after sysfs_create_bin_file() completes.

Fixes: aeda33ab8160 ("cdx: create sysfs bin files for cdx resources")
Cc: stable@vger.kernel.org
Signed-off-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com>
---
 drivers/cdx/cdx.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/cdx/cdx.c b/drivers/cdx/cdx.c
index d3d230247262..a118a89a7779 100644
--- a/drivers/cdx/cdx.c
+++ b/drivers/cdx/cdx.c
@@ -738,7 +738,6 @@ static int cdx_create_res_attr(struct cdx_device *cdx_dev, int num)
 
 	sysfs_bin_attr_init(res_attr);
 
-	cdx_dev->res_attr[num] = res_attr;
 	sprintf(res_attr_name, "resource%d", num);
 
 	res_attr->mmap = cdx_mmap_resource;
@@ -747,8 +746,12 @@ static int cdx_create_res_attr(struct cdx_device *cdx_dev, int num)
 	res_attr->size = cdx_resource_len(cdx_dev, num);
 	res_attr->private = (void *)(unsigned long)num;
 	ret = sysfs_create_bin_file(&cdx_dev->dev.kobj, res_attr);
-	if (ret)
+	if (ret) {
 		kfree(res_attr);
+		return ret;
+	}
+
+	cdx_dev->res_attr[num] = res_attr;
 
 	return ret;
 }
-- 
2.49.0

RE: [PATCH v2] cdx: Fix double free when sysfs file creation fails

[Agarwal, Nikhil]

> -----Original Message-----
> From: Prasanna Kumar T S M <ptsm@linux.microsoft.com>
> Sent: Friday, July 24, 2026 2:57 PM
> To: Gupta, Nipun <Nipun.Gupta@amd.com>; Agarwal, Nikhil
> <nikhil.agarwal@amd.com>; gregkh@linuxfoundation.org; Gupta, Puneet (DCG-
> ENG) <puneet.gupta@amd.com>; Gangurde, Abhijit
> <abhijit.gangurde@amd.com>; linux-kernel@vger.kernel.org;
> ptsm@linux.microsoft.com
> Cc: ssengar@linux.microsoft.com
> Subject: [PATCH v2] cdx: Fix double free when sysfs file creation fails
> 
> In cdx_create_res_attr(), if sysfs_create_bin_file() fails, the code frees res_attr but
> doesn't set cdx_dev->res_attr[num] to NULL. This leaves a dangling pointer in the
> array. Then cdx_destroy_res_attr() frees the already-freed memory. Fix the double
> free by initializing cdx_dev->res_attr[num] after sysfs_create_bin_file() completes.
> 
> Fixes: aeda33ab8160 ("cdx: create sysfs bin files for cdx resources")
> Cc: stable@vger.kernel.org
> Signed-off-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com>

Acked-by: Nikhil Agarwal <Nikhil.agarwal@amd.com>