[PATCH 1/1] mcb: fix a double free bug in chameleon_parse_gdd()

From: Johannes Thumshirn
Date: Mon Mar 10 2025 - 04:47:28 EST


From: Haoxiang Li <haoxiang_li2024@xxxxxxx>

In chameleon_parse_gdd(), if mcb_device_register() fails, 'mdev'
would be released in mcb_device_register() via put_device().
Thus, goto 'err' label and free 'mdev' again causes a double free.
Just return if mcb_device_register() fails.

Fixes: 3764e82e5150 ("drivers: Introduce MEN Chameleon Bus")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Haoxiang Li <haoxiang_li2024@xxxxxxx>
Signed-off-by: Johannes Thumshirn <jth@xxxxxxxxxx>
---
drivers/mcb/mcb-parse.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
index 02a680c73979..bf0d7d58c8b0 100644
--- a/drivers/mcb/mcb-parse.c
+++ b/drivers/mcb/mcb-parse.c
@@ -96,7 +96,7 @@ static int chameleon_parse_gdd(struct mcb_bus *bus,

ret = mcb_device_register(bus, mdev);
if (ret < 0)
- goto err;
+ return ret;

return 0;

--
2.43.0