misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe()
BugLink: https://bugs.launchpad.net/bugs/2074091
commit 086c6cbcc563c81d55257f9b27e14faf1d0963d3 upstream.
When auxiliary_device_add() returns error and then calls
auxiliary_device_uninit(), callback function
gp_auxiliary_device_release() calls ida_free() and
kfree(aux_device_wrapper) to free memory. We should't
call them again in the error handling path.
Fix this by skipping the redundant cleanup functions.
Fixes: 393fc2f594 ("misc: microchip: pci1xxxx: load auxiliary bus driver for the PIO function in the multi-function endpoint of pci1xxxx device.")
Signed-off-by: Yongzhi Liu <hyperlyzcs@gmail.com>
Link: https://lore.kernel.org/r/20240523121434.21855-3-hyperlyzcs@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Portia Stephens <portia.stephens@canonical.com>
Signed-off-by: Roxana Nicolescu <roxana.nicolescu@canonical.com>
This commit is contained in:
committed by
Roxana Nicolescu
parent
8da7f81d16
commit
3975d46e1f
@@ -111,6 +111,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id
|
||||
|
||||
err_aux_dev_add_1:
|
||||
auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev);
|
||||
goto err_aux_dev_add_0;
|
||||
|
||||
err_aux_dev_init_1:
|
||||
ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[1]->aux_dev.id);
|
||||
@@ -120,6 +121,7 @@ err_ida_alloc_1:
|
||||
|
||||
err_aux_dev_add_0:
|
||||
auxiliary_device_uninit(&aux_bus->aux_device_wrapper[0]->aux_dev);
|
||||
goto err_ret;
|
||||
|
||||
err_aux_dev_init_0:
|
||||
ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[0]->aux_dev.id);
|
||||
@@ -127,6 +129,7 @@ err_aux_dev_init_0:
|
||||
err_ida_alloc_0:
|
||||
kfree(aux_bus->aux_device_wrapper[0]);
|
||||
|
||||
err_ret:
|
||||
return retval;
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user