driver core: bus: Fix a potential double free
The .release function of driver_ktype is 'driver_release()'. This function frees the container_of this kobject. So, this memory must not be freed explicitly in the error handling path of 'bus_add_driver()'. Otherwise a double free will occur. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>zero-colors
parent
7521621e60
commit
0f9b011d33
|
@ -698,7 +698,7 @@ int bus_add_driver(struct device_driver *drv)
|
||||||
|
|
||||||
out_unregister:
|
out_unregister:
|
||||||
kobject_put(&priv->kobj);
|
kobject_put(&priv->kobj);
|
||||||
kfree(drv->p);
|
/* drv->p is freed in driver_release() */
|
||||||
drv->p = NULL;
|
drv->p = NULL;
|
||||||
out_put_bus:
|
out_put_bus:
|
||||||
bus_put(bus);
|
bus_put(bus);
|
||||||
|
|
Loading…
Reference in New Issue