Re: [PATCH v4] uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory

[Greg Kroah-Hartman]

On Thu, Feb 26, 2026 at 11:32:50PM +0800, Guangshuo Li wrote:
> uio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in
> probe(), but then calls kfree(udev) both on the probe() error path
> (label out_free) and again in remove().
> 
> Because devm_kzalloc() allocations are devres-managed and are freed
> automatically when the device is detached (including after a failing
> probe() and during driver unbind), the explicit kfree() can lead to a
> double free.
> 
> If probe() fails after devm_kzalloc(), the error path frees udev and
> devres cleanup will free it again when the core unwinds the partially
> bound device. On normal driver removal, remove() frees udev and devres
> will free it again when the device is detached.
> 
> This issue was identified by a static analysis tool I developed and
> confirmed by manual review. Fix by removing the manual kfree() calls
> and dropping the now-unused label.
> 
> Fixes: 3397c3cd859a2 ("uio: Add SVA support for PCI devices via uio_pci_generic_sva.c")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
> ---
> v4:
>   - Add description of how the issue was found and tested.
> 
> v3:
>   - Add changelog below the --- line describing changes since v2.
> 
> v2:
>   - Reflow commit message to keep lines within 75 characters.
> 
>  drivers/uio/uio_pci_generic_sva.c | 5 +----
>  1 file changed, 1 insertion(+), 4 deletions(-)
> 
> diff --git a/drivers/uio/uio_pci_generic_sva.c b/drivers/uio/uio_pci_generic_sva.c
> index 4a46acd994a8..152201047334 100644
> --- a/drivers/uio/uio_pci_generic_sva.c
> +++ b/drivers/uio/uio_pci_generic_sva.c
> @@ -129,15 +129,13 @@ static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  	ret = devm_uio_register_device(&pdev->dev, &udev->info);
>  	if (ret) {
>  		dev_err(&pdev->dev, "Failed to register uio device\n");
> -		goto out_free;
> +		goto out_disable;
>  	}
>  
>  	pci_set_drvdata(pdev, udev);
>  
>  	return 0;
>  
> -out_free:
> -	kfree(udev);
>  out_disable:
>  	pci_disable_device(pdev);
>  
> @@ -150,7 +148,6 @@ static void remove(struct pci_dev *pdev)
>  
>  	pci_release_regions(pdev);
>  	pci_disable_device(pdev);
> -	kfree(udev);
>  }
>  
>  static ssize_t pasid_show(struct device *dev,
> -- 
> 2.43.0
> 

Breaks the build, how did you test this:
  CC [M]  drivers/uio/uio_pci_generic_sva.o
drivers/uio/uio_pci_generic_sva.c:147:26: error: unused variable 'udev' [-Werror,-Wunused-variable]
  147 |         struct uio_pci_sva_dev *udev = pci_get_drvdata(pdev);
      |                                 ^~~~
1 error generated.

{sigh}