Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2c97bb69 authored by Christophe JAILLET's avatar Christophe JAILLET Committed by Greg Kroah-Hartman
Browse files

driver core: bus: Fix a potential double free 



commit 0f9b011d3321ca1079c7a46c18cb1956fbdb7bcb upstream.

The .release function of driver_ktype is 'driver_release()'.
This function frees the container_of this kobject.

So, this memory must not be freed explicitly in the error handling path of
'bus_add_driver()'. Otherwise a double free will occur.

Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 158333ad

drivers/base/bus.c

+1 −1
Original line number Diff line number Diff line
@@ -722,7 +722,7 @@ int bus_add_driver(struct device_driver *drv) 


out_unregister:

	kobject_put(&priv->kobj);

	kfree(drv->p);

	/* drv->p is freed in driver_release()  */

	drv->p = NULL;

out_put_bus:

	bus_put(bus);