Re: [PATCH v2] dmaengine: idxd: fix double free in idxd_alloc() error path

[Vinicius Costa Gomes]

Guangshuo Li <lgs201920130244@xxxxxxxxx> writes:

> When dev_set_name() fails after device_initialize(), idxd_alloc()
> calls put_device(conf_dev).
>
> For these devices, conf_dev->type is set from idxd->data->dev_type,
> which resolves to dsa_device_type or iax_device_type, and both use
> idxd_conf_device_release() as their release callback. That release
> callback frees idxd, idxd->opcap_bmap, and releases idxd->id, but
> the current error path then frees those resources again directly,
> causing a double free.
>
> The issue was identified by a static analysis tool I developed and
> confirmed by manual review.
>
> Keep the cleanup in idxd_conf_device_release() after put_device() and
> avoid freeing idxd-managed resources again in idxd_alloc().
>
> Fixes: 46a5cca76c76 ("dmaengine: idxd: fix memory leak in error handling path of idxd_alloc")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
> ---

On the review of 'v1', you agreed to the comments I made, but they are
neither reflected in the code nor in the series organization.


-- 
Vinicius