Skip to content

Commit 086c6cb

Browse files
Yongzhi Liugregkh
authored andcommitted
misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe()
When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), callback function gp_auxiliary_device_release() calls ida_free() and kfree(aux_device_wrapper) to free memory. We should't call them again in the error handling path. Fix this by skipping the redundant cleanup functions. Fixes: 393fc2f ("misc: microchip: pci1xxxx: load auxiliary bus driver for the PIO function in the multi-function endpoint of pci1xxxx device.") Signed-off-by: Yongzhi Liu <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 parent 73fedc3 commit 086c6cb

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id
111111

112112
err_aux_dev_add_1:
113113
auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev);
114+
goto err_aux_dev_add_0;
114115

115116
err_aux_dev_init_1:
116117
ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[1]->aux_dev.id);
@@ -120,13 +121,15 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id
120121

121122
err_aux_dev_add_0:
122123
auxiliary_device_uninit(&aux_bus->aux_device_wrapper[0]->aux_dev);
124+
goto err_ret;
123125

124126
err_aux_dev_init_0:
125127
ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[0]->aux_dev.id);
126128

127129
err_ida_alloc_0:
128130
kfree(aux_bus->aux_device_wrapper[0]);
129131

132+
err_ret:
130133
return retval;
131134
}
132135

0 commit comments

Comments
 (0)