Re: [PATCH net v2] dibs: fix double free of dmb_clientid_arr
Dust Li <dust.li-KPsoFbNs7GizrGE5bRqYAgC/[email protected]>
| Newsgroups | gmane.linux.drivers.rdma,gmane.linux.network,gmane.linux.kernel |
|---|---|
| Message-ID | <[email protected]> |
On 2026-08-06 14:04:47, Hidayath Khan wrote:
>dibs_dev_add() frees dibs->dmb_clientid_arr on both of its failure
>paths, but does not clear the pointer. dibs_lo_dev_probe() then frees
>the same pointer again in its err_reg path, so a failing device_add()
>or sysfs_create_group() results in a double free.
>
>Drop the kfree() from dibs_lo_dev_probe().
>
>Fixes: cc21191b584c ("dibs: Move data path to dibs layer")
>Cc: [email protected]
>Reviewed-by: Alexandra Winter <[email protected]>
>Signed-off-by: Hidayath Khan <[email protected]>
Reviewed-by: Dust Li <dust.li-KPsoFbNs7GizrGE5bRqYAgC/[email protected]>
Best regards,
Dust