Re: [PATCH v2] drivers/base/node: Handle error properly in register_one_node()

[Donet Tom]

On 9/18/25 3:18 AM, Andrew Morton wrote:
> On Wed, 17 Sep 2025 20:25:48 +0530 Donet Tom <donettom@xxxxxxxxxxxxx> wrote:
>
> > > Can this cause a double-free? Looking at register_node(), when
> > > device_register() fails, it calls put_device(&node->dev). The put_device()
> > > call triggers node_device_release() which does kfree(to_node(dev)), freeing
> > > the entire node structure. So when register_node() returns an error, the
> > > node memory is already freed, but this code calls kfree(node) again on the
> > > same memory.
> > >
> > > The call chain is: register_node()->device_register() fails->
> > > put_device()->node_device_release()->kfree(to_node(dev)).
> >
> > Thank you for pointing this out. I will address it and send a v3.
> This patch is now in mm.git's non-rebasing mm-stable branch, so no
> replacements, please.
>
> A standalone patch with
>
> 	Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()")
>
> is the way to go.


Sure Andrew .I will send it today.


>