[PATCH] devcoredump: fix double free on device registration failure

[PATCH] devcoredump: fix double free on device registration failure

[Johan Hovold]

The device coredump class release function devcd_dev_release() puts the
module reference and frees the data so just return after dropping the
device reference on registration failures to avoid a module reference
imbalance and double free.

This issue was flagged by an LLM.

Fixes: 833c95456a70 ("device coredump: add new device coredump class")
Cc: stable@vger.kernel.org	# 3.18
Cc: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/base/devcoredump.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/base/devcoredump.c b/drivers/base/devcoredump.c
index 8bb1763083dd..16e99ac926a7 100644
--- a/drivers/base/devcoredump.c
+++ b/drivers/base/devcoredump.c
@@ -433,10 +433,12 @@ void dev_coredumpm_timeout(struct device *dev, struct module *owner,
 	devcd->init_completed = true;
 	mutex_unlock(&devcd->mutex);
 	return;
+
  put_device:
 	mutex_unlock(&devcd->mutex);
 	cancel_delayed_work_sync(&devcd->del_wk);
 	put_device(&devcd->devcd_dev);
+	return;
 
  put_module:
 	module_put(owner);
-- 
2.55.0

Re: [PATCH] devcoredump: fix double free on device registration failure

[Danilo Krummrich]

On Mon,  2 Nov 2026 09:25:36 +0100, Johan Hovold wrote:
> [PATCH] devcoredump: fix double free on device registration failure

Applied, thanks!

  Branch: driver-core-testing
  Tree:   git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core.git

[1/1] devcoredump: fix double free on device registration failure
      commit: de7625abe4e9

The patch will appear in the next linux-next integration (typically within 24
hours on weekdays).

The patch is in the driver-core-testing branch and will be promoted to
driver-core-next after validation.