Re: [PATCH v2 2/4] staging: rtl8723bs: fix double free when register_netdev() fails

[Greg KH]

On Thu, Jul 30, 2026 at 01:59:58PM +0800, Yi Cong wrote:
> From: Yi Cong <yicong@xxxxxxxxxx>
> 
> When register_netdev() fails, the error_register_netdev label in
> _rtw_drv_register_netdev() frees the adapter and netdev via
> rtw_free_drv_sw()/rtw_free_netdev() and then returns _FAIL.
> 
> The caller rtw_drv_init(), however, still holds a non-NULL if1 on this
> failure path and jumps to free_if1, where rtw_sdio_if1_deinit() invokes
> rtw_free_drv_sw() and rtw_free_netdev() again on the same already-freed
> objects, resulting in a double free / use-after-free.
> 
> Drop the freeing from error_register_netdev and let rtw_sdio_if1_deinit()
> perform the tear-down, which is the single owner for this path.
> 
> Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
> Signed-off-by: Yi Cong <yicong@xxxxxxxxxx>

You forgot to use the proper "Assisted-by:" tags for this series, right?

thanks,

greg k-h