Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

rtc: class: fix double free in rtc_register_device() error path

Commit 59cca865f21e ("drivers/rtc/class.c: fix device_register() error
handling") correctly noted that naked kfree() should not be used after
failed device_register() call, however, while it added the needed
put_device() it forgot to remove the original kfree() causing double-free.

Cc: Vasiliy Kulikov <segooon@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>

authored by

Dmitry Torokhov and committed by
Alexandre Belloni
6706664d dfe6c04a

+2 -4
+2 -4
drivers/rtc/class.c
··· 234 234 235 235 err = device_register(&rtc->dev); 236 236 if (err) { 237 + /* This will free both memory and the ID */ 237 238 put_device(&rtc->dev); 238 - goto exit_kfree; 239 + goto exit; 239 240 } 240 241 241 242 rtc_dev_add_device(rtc); ··· 247 246 rtc->name, dev_name(&rtc->dev)); 248 247 249 248 return rtc; 250 - 251 - exit_kfree: 252 - kfree(rtc); 253 249 254 250 exit_ida: 255 251 ida_simple_remove(&rtc_ida, id);