Commit 6706664d authored Jul 20, 2015 by Dmitry Torokhov Committed by Alexandre Belloni Sep 05, 2015

rtc: class: fix double free in rtc_register_device() error path

Commit 59cca865 ("drivers/rtc/class.c: fix device_register() error
handling") correctly noted that naked kfree() should not be used after
failed device_register() call, however, while it added the needed
put_device() it forgot to remove the original kfree() causing double-free.

Cc: Vasiliy Kulikov <segooon@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>

parent dfe6c04a

drivers/rtc/class.c

+2 −4

Original line number	Diff line number	Diff line
		@@ -234,8 +234,9 @@ struct rtc_device rtc_device_register(const char name, struct device *dev,

		err = device_register(&rtc->dev);
		if (err) {
		/* This will free both memory and the ID */
		put_device(&rtc->dev);
		goto exit_kfree;
		goto exit;
		}

		rtc_dev_add_device(rtc);
		@@ -247,9 +248,6 @@ struct rtc_device rtc_device_register(const char name, struct device *dev,

		return rtc;

		exit_kfree:
		kfree(rtc);

		exit_ida:
		ida_simple_remove(&rtc_ida, id);