Re: [PATCH 2/4] staging: rtl8723bs: fix double free when register_netdev() fails

[Dan Carpenter]

On Wed, Jul 29, 2026 at 10:25:07AM +0800, Yi Cong wrote:
> From: Yi Cong <yicong@xxxxxxxxxx>
> 
> When register_netdev() fails, the error_register_netdev label in
> _rtw_drv_register_netdev() frees the adapter and netdev via
> rtw_free_drv_sw()/rtw_free_netdev() and then returns _FAIL.
> 
> The caller rtw_drv_init(), however, still holds a non-NULL if1 on this
> failure path and jumps to free_if1, where rtw_sdio_if1_deinit() invokes
> rtw_free_drv_sw() and rtw_free_netdev() again on the same already-freed
> objects, resulting in a double free / use-after-free.
> 
> Drop the freeing from error_register_netdev and let rtw_sdio_if1_deinit()
> perform the tear-down, which is the single owner for this path.
> 
> Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
> Signed-off-by: Yi Cong <yicong@xxxxxxxxxx>
> ---
>  drivers/staging/rtl8723bs/os_dep/os_intfs.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/staging/rtl8723bs/os_dep/os_intfs.c b/drivers/staging/rtl8723bs/os_dep/os_intfs.c
> index f31196f54b3e..ac401042faf4 100644
> --- a/drivers/staging/rtl8723bs/os_dep/os_intfs.c
> +++ b/drivers/staging/rtl8723bs/os_dep/os_intfs.c
> @@ -773,10 +773,12 @@ static int _rtw_drv_register_netdev(struct adapter *padapter, char *name)
>  
>  error_register_netdev:
>  
> -	rtw_free_drv_sw(padapter);
> -
> -	rtw_free_netdev(pnetdev);
> -
> +	/* Let the caller (rtw_drv_init -> rtw_sdio_if1_deinit) release the
> +	 * adapter and netdev. Freeing them here would lead to a double free:
> +	 * rtw_drv_init() still holds a non-NULL if1 and calls
> +	 * rtw_sdio_if1_deinit(), which invokes rtw_free_drv_sw() and
> +	 * rtw_free_netdev() again on the already-freed objects.
> +	 */

No need for this comment.  These weren't allocated in
_rtw_drv_register_netdev() and no one really expects them to be
freed here either.  AI always adds obvious comments but eventually
the kernel will turn into the Terms of Service text which no one can
possibly read in a life time.

regards,
dan carpenter