From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 187593AFD00 for ; Wed, 29 Jul 2026 05:31:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785303093; cv=none; b=TKng3bRqKXRaoNUpcFayw8W8wM0o65afrxyn03iqzo2Ht0DMdQxmeZVUOsMmXuUe9hd02p2J4mu7ISAvq7Li0m68j6i5PquyX9EJAB/gn4HXE+uKUczYE/bCZKuce0ps5wOD4Q6tF+WFAqc8yxXSNEaC030PvvDuqrF1TylWTAc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785303093; c=relaxed/simple; bh=TK73DyNBFNgavPIJ8NX7LzeWA/wjG1g5dTxoKb05AaU=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=RuxITD5f1k8nxDj/jsTmcNsVdSlg8pFtrRGQOO6twgJU5Hi3leS1EGLcmD+cdm2xyQwS21jJrRnqVmIV0yuq0HWWqk17jQM7xbIgffF8UI6fEECd+4bAlvYcbLnscpQFgBpTM+5QrcRqhvbELtCbNgFac5TkxYYjDH2Vrs6E9yc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mHrEPotl; arc=none smtp.client-ip=209.85.128.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mHrEPotl" Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4955158f26aso3182885e9.3 for ; Tue, 28 Jul 2026 22:31:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785303090; x=1785907890; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=ZZkhjXFCyNRKV6oXHNjuiRGL2GiMm192P3++mpEhAgw=; b=mHrEPotlLNvS8C6SrW/UtuFx2D9wHvXhYxFJAT1Dm+SbmiaU8mVO6HacECQqYyC0se afdZ98wxFEaMGdncnmNx2p02fya0WlDB9ynH+xTWVpsc899Se/P0tYTHe/NzZ+Wbg8rC kOveryLb4IbVHx6Mb9iSyVkA0x+vya71+cZsB2UpSC/AuiMu1PE2QsXHB5JH2m9bab0S hhfY4yKQR0J8D9JyExFHMTqQRaKqnMvmYq5CQedc9Ph7VrRreK5QzDrgsXBQ5T5+oESo jY3evf0LjK7eQy24xXWW6QxkyyGMU+u20av5v/fdAyAlLng4oEaLrgFPVoSK5QjEdq+N Nw3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785303090; x=1785907890; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=ZZkhjXFCyNRKV6oXHNjuiRGL2GiMm192P3++mpEhAgw=; b=hCBgy/RutsY1LQvtYYtlijdrXRS6KhyDpMj/mgFekeRnvhG4ndr3UcC5aTDzyUL9f7 fzWLQquXeOl0OdlDrbw/NLqC+zRBsmHnSHYUkiEEAKUk9dYpb2+Qp5b5VnQk/OykrOBH xFpyhIZXdFZtKWMs3aEvheoIAgPQJMXcOBmYCfrdOtX1fyWCL4UxSoiLSfmIxZtlrAbd YnYp4Fw5qwPJ+CQyEgoAxZG51WAefRC2uduT4stTgrJ6O2fpHRI70+4k8CGHYkUGfl12 hdnc/VMT1wpMfI4epFTQLAsz5lRR6/IvIygCYDL2DuSwRBATcwTGuXPAnCDuMQIHSea8 e+JA== X-Forwarded-Encrypted: i=1; AHgh+Rpfw6FAeljnmVkRBmbKX90Pe89Vgq+gJSQG+R9iPLvznvoFrXvjq4ldeZeI68ChpeiaODdLMplx4AhgJtc=@vger.kernel.org X-Gm-Message-State: AOJu0Ywj+MJuYGA2oh4HAN9I+8/wMKx/JaEVNfTWwRNAk8se7qVdm3Mh 8XZFQv17YTXdG/JNhP2miNdLLwHJ00BhEmyOSv7GWiFUdpkcDRMM1sd/ X-Gm-Gg: AR+sD10apmZz2dZ0+tdtw4xiCysu/jgZMnJqhPiDCzAjSK9JjGCW4NwFYFzRrtIrCii nrdecdaCaPLcgpNwCSq5ylZBrDJl2JG1ykA4Y9q3EMmmdNhIP5HCzx/5VKIcS9hyI0N4HtA0HrF NUGE24rgsmSOad96r/67scCv+T7mUyviC6cZnhR3vdeVAjoTY3Q1T6qr7Ej0z+HOwt4IixnzyV+ sqhPlx/czZTFWR012vTaFP7HjfoIMopP/TeyCQE70MWgJA9rQ3z/prKJYt4MpT9UeGIXrWdtItJ 3hggcXto2PwvX8fCKuC1cBSaSCjl8V9QoVOqA73aIFgJRYF9aFF0tZrjVQjZc04IKI7PWv80jHq puIPYq850pcfn1oqtDDhncdtDTjWG1k4XmdCCjv5+Ly86AFs4IyDqkVm4ObIbhcR8q0SxpUYywv OobJFnEzs16zjkj4xbP0p3dOdKeyrInnJfhd/kiNelb5UfJ60zYE5YjB1X X-Received: by 2002:a05:600c:6986:b0:495:3aac:1098 with SMTP id 5b1f17b1804b1-496c6591311mr60736795e9.32.1785303090216; Tue, 28 Jul 2026 22:31:30 -0700 (PDT) Received: from localhost ([2c0f:3d00:6be:8900:ce5e:9212:ea4b:f30]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4957bff4784sm337623375e9.4.2026.07.28.22.31.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 Jul 2026 22:31:29 -0700 (PDT) Date: Wed, 29 Jul 2026 08:31:26 +0300 From: Dan Carpenter To: Yi Cong Cc: gregkh@linuxfoundation.org, linux-staging@lists.linux.dev, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Yi Cong Subject: Re: [PATCH 2/4] staging: rtl8723bs: fix double free when register_netdev() fails Message-ID: References: <20260729022509.2863634-1-cong.yi@linux.dev> <20260729022509.2863634-3-cong.yi@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260729022509.2863634-3-cong.yi@linux.dev> On Wed, Jul 29, 2026 at 10:25:07AM +0800, Yi Cong wrote: > From: Yi Cong > > When register_netdev() fails, the error_register_netdev label in > _rtw_drv_register_netdev() frees the adapter and netdev via > rtw_free_drv_sw()/rtw_free_netdev() and then returns _FAIL. > > The caller rtw_drv_init(), however, still holds a non-NULL if1 on this > failure path and jumps to free_if1, where rtw_sdio_if1_deinit() invokes > rtw_free_drv_sw() and rtw_free_netdev() again on the same already-freed > objects, resulting in a double free / use-after-free. > > Drop the freeing from error_register_netdev and let rtw_sdio_if1_deinit() > perform the tear-down, which is the single owner for this path. > > Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") > Signed-off-by: Yi Cong > --- > drivers/staging/rtl8723bs/os_dep/os_intfs.c | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) > > diff --git a/drivers/staging/rtl8723bs/os_dep/os_intfs.c b/drivers/staging/rtl8723bs/os_dep/os_intfs.c > index f31196f54b3e..ac401042faf4 100644 > --- a/drivers/staging/rtl8723bs/os_dep/os_intfs.c > +++ b/drivers/staging/rtl8723bs/os_dep/os_intfs.c > @@ -773,10 +773,12 @@ static int _rtw_drv_register_netdev(struct adapter *padapter, char *name) > > error_register_netdev: > > - rtw_free_drv_sw(padapter); > - > - rtw_free_netdev(pnetdev); > - > + /* Let the caller (rtw_drv_init -> rtw_sdio_if1_deinit) release the > + * adapter and netdev. Freeing them here would lead to a double free: > + * rtw_drv_init() still holds a non-NULL if1 and calls > + * rtw_sdio_if1_deinit(), which invokes rtw_free_drv_sw() and > + * rtw_free_netdev() again on the already-freed objects. > + */ No need for this comment. These weren't allocated in _rtw_drv_register_netdev() and no one really expects them to be freed here either. AI always adds obvious comments but eventually the kernel will turn into the Terms of Service text which no one can possibly read in a life time. regards, dan carpenter