firmware: arm_scmi: Avoid double free in error flow
commit5.4-rM2-2.2.x-imx-squashed8305e90a89
upstream. If device_register() fails, both put_device() and kfree() are called, ending with a double free of the scmi_dev. Calling kfree() is needed only when a failure happens between the allocation of the scmi_dev and its registration, so move it to there and remove it from the error flow. Fixes:46edb8d132
("firmware: arm_scmi: provide the mandatory device release callback") Signed-off-by: Wen Yang <wenyang@linux.alibaba.com> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
3d29dc60aa
commit
7da501c21a
|
@ -135,8 +135,10 @@ scmi_device_create(struct device_node *np, struct device *parent, int protocol)
|
|||
return NULL;
|
||||
|
||||
id = ida_simple_get(&scmi_bus_id, 1, 0, GFP_KERNEL);
|
||||
if (id < 0)
|
||||
goto free_mem;
|
||||
if (id < 0) {
|
||||
kfree(scmi_dev);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
scmi_dev->id = id;
|
||||
scmi_dev->protocol_id = protocol;
|
||||
|
@ -154,8 +156,6 @@ scmi_device_create(struct device_node *np, struct device *parent, int protocol)
|
|||
put_dev:
|
||||
put_device(&scmi_dev->dev);
|
||||
ida_simple_remove(&scmi_bus_id, id);
|
||||
free_mem:
|
||||
kfree(scmi_dev);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue