Skip to content

Commit

Permalink
parport: fix freeing freed memory
Browse files Browse the repository at this point in the history
After the reference count becomes 0 when put_device() is called, it will
execute the release callback where we are freeing all the allocated
memory associated with the device. So if we just continue on the error
path then we are again freeing devname and trying to dereference par_dev
which has already been free-ed in the release callback.

Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Sudip Mukherjee authored and Greg Kroah-Hartman committed Jul 23, 2015
1 parent 23c4059 commit 68d35c7
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions drivers/parport/share.c
Original file line number Diff line number Diff line change
Expand Up @@ -892,8 +892,10 @@ parport_register_dev_model(struct parport *port, const char *name,
par_dev->dev.release = free_pardevice;
par_dev->devmodel = true;
ret = device_register(&par_dev->dev);
if (ret)
goto err_put_dev;
if (ret) {
put_device(&par_dev->dev);
goto err_put_port;
}

/* Chain this onto the list */
par_dev->prev = NULL;
Expand Down Expand Up @@ -940,8 +942,6 @@ parport_register_dev_model(struct parport *port, const char *name,

return par_dev;

err_put_dev:
put_device(&par_dev->dev);
err_free_devname:
kfree(devname);
err_free_par_dev:
Expand Down

0 comments on commit 68d35c7

Please sign in to comment.