Skip to content

Commit

Permalink
misc: microchip: pci1xxxx: fix double free in the error handling of g…
Browse files Browse the repository at this point in the history
…p_aux_bus_probe()

When auxiliary_device_add() returns error and then calls
auxiliary_device_uninit(), callback function
gp_auxiliary_device_release() calls ida_free() and
kfree(aux_device_wrapper) to free memory. We should't
call them again in the error handling path.

Fix this by skipping the redundant cleanup functions.

Fixes: 393fc2f ("misc: microchip: pci1xxxx: load auxiliary bus driver for the PIO function in the multi-function endpoint of pci1xxxx device.")
Signed-off-by: Yongzhi Liu <hyperlyzcs@gmail.com>
Link: https://lore.kernel.org/r/20240523121434.21855-3-hyperlyzcs@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Yongzhi Liu authored and Greg Kroah-Hartman committed Jun 4, 2024
1 parent 73fedc3 commit 086c6cb
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id

err_aux_dev_add_1:
auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev);
goto err_aux_dev_add_0;

err_aux_dev_init_1:
ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[1]->aux_dev.id);
Expand All @@ -120,13 +121,15 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id

err_aux_dev_add_0:
auxiliary_device_uninit(&aux_bus->aux_device_wrapper[0]->aux_dev);
goto err_ret;

err_aux_dev_init_0:
ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[0]->aux_dev.id);

err_ida_alloc_0:
kfree(aux_bus->aux_device_wrapper[0]);

err_ret:
return retval;
}

Expand Down

0 comments on commit 086c6cb

Please sign in to comment.