[PATCH] intel_th: Clear dangling resource pointer in subdevice alloc error path

[Haotian Zhang]

When device_add() fails, intel_th_subdevice_alloc() jumps to
fail_free_res which kfree()s thdev->resource but leaves the pointer
dangling, then falls through to fail_put_device where put_device()
triggers the .release callback intel_th_device_free() which kfree()s
thdev->resource again, causing a double free.

Set thdev->resource to NULL after kfree() so the subsequent
intel_th_device_free() finds a NULL pointer and skips it.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: a753bfcfdb1f ("intel_th: Make the switch allocate its subdevices")
Signed-off-by: Haotian Zhang <vulab@xxxxxxxxxxx>
---
 drivers/hwtracing/intel_th/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
index 3924e63e2eee..3ab1a37b045e 100644
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -696,6 +696,7 @@ intel_th_subdevice_alloc(struct intel_th *th,
 
 fail_free_res:
 	kfree(thdev->resource);
+	thdev->resource = NULL;
 
 fail_put_device:
 	put_device(&thdev->dev);
-- 
2.25.1