Re: [PATCH] intel_th: avoid double free in error flow

From: Wen Yang
Date: Wed Nov 20 2019 - 08:46:06 EST

On 2019/11/20 9:38 äå, Alexander Shishkin wrote:
Wen Yang <wenyang@xxxxxxxxxxxxxxxxx> writes:

Another example after a few lines lower:

ÂÂÂÂÂÂÂ err = device_add(&thdev->dev);

ÂÂÂÂÂÂÂ if (err) {
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ put_device(&thdev->dev);
ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ goto fail_free_res;


device_add() has increased the reference count,

so when it returns an error, an additional call to put_device()

is needed here to reduce the reference count.

So the code in this place is correct.
No, device_add() drops its own extra reference in case of error (as it
should), so in "if (err) ..." branch we still only have just one
reference before it goes free.


Well, ok, you are right.

We just checked the code and device_add() does release the reference count.

Thank you.