[PATCH net v2] dibs: fix double free of dmb_clientid_arr
Hidayath Khan <[email protected]>
| Newsgroups | org.kernel.vger.linux-rdma,org.kernel.vger.linux-kernel,org.kernel.vger.linux-s390,org.kernel.vger.netdev |
|---|---|
| Message-ID | <[email protected]> |
dibs_dev_add() frees dibs->dmb_clientid_arr on both of its failure
paths, but does not clear the pointer. dibs_lo_dev_probe() then frees
the same pointer again in its err_reg path, so a failing device_add()
or sysfs_create_group() results in a double free.
Drop the kfree() from dibs_lo_dev_probe().
Fixes: cc21191b584c ("dibs: Move data path to dibs layer")
Cc: [email protected]
Reviewed-by: Alexandra Winter <[email protected]>
Signed-off-by: Hidayath Khan <[email protected]>
---
v2:
- Fix Fixes: tag (was c3a910f2380f, should be cc21191b584c)
- Remove incorrect Note paragraph copied from a different patch
drivers/dibs/dibs_loopback.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/dibs/dibs_loopback.c b/drivers/dibs/dibs_loopback.c
index fd5caf1e19a8..649e4e375be3 100644
--- a/drivers/dibs/dibs_loopback.c
+++ b/drivers/dibs/dibs_loopback.c
@@ -335,7 +335,6 @@ static int dibs_lo_dev_probe(void)
return 0;
err_reg:
- kfree(dibs->dmb_clientid_arr);
/* pairs with dibs_dev_alloc() */
put_device(&dibs->dev);
kfree(ldev);
base-commit: 92a09f2af870e91efb9471b109db15c2030f90f2
--
2.52.0