RE: [PATCH next] PM / devfreq: Fix double free in devfreq_event_add_edev()

[Kumar, Kaushlendra]

Hi Dan,

On [Date], Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
> The put_device() function calls devfreq_event_release_edev() which frees "evdev".  Calling kfree() again is a double free.
> 
> Fixes: 430a1845c804 ("PM / devfreq: Fix memory leak in devfreq_event_add_edev()")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> ---
>  drivers/devfreq/devfreq-event.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/devfreq/devfreq-event.c b/drivers/devfreq/devfreq-event.c index 34406c52b845..70219099c604 100644
> --- a/drivers/devfreq/devfreq-event.c
> +++ b/drivers/devfreq/devfreq-event.c
> @@ -328,7 +328,6 @@ struct devfreq_event_dev *devfreq_event_add_edev(struct device *dev,
> 	ret = device_register(&edev->dev);
> 	if (ret < 0) {
> 		put_device(&edev->dev);
> -		kfree(edev);
> 		return ERR_PTR(ret);
> 	}
> 	dev_set_drvdata(&edev->dev, edev);

Thank you for catching this double-free issue! You're absolutely right - 
the release function handles the memory cleanup, making the explicit kfree() 
incorrect.

Reviewed-by: Kaushlendra Kumar <kaushlendra.kumar@xxxxxxxxx>

Best regards,
Kaushlendra Kumar