Re: [PATCH v2 2/4] staging: rtl8723bs: fix double free when register_netdev() fails

[Yi Cong]

On Thu, 30 Jul 2026 09:38:25 +0200, Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
>
> On Thu, Jul 30, 2026 at 01:59:58PM +0800, Yi Cong wrote:
> > From: Yi Cong <yicong@xxxxxxxxxx>
> > 
> > When register_netdev() fails, the error_register_netdev label in
> > _rtw_drv_register_netdev() frees the adapter and netdev via
> > rtw_free_drv_sw()/rtw_free_netdev() and then returns _FAIL.
> > 
> > The caller rtw_drv_init(), however, still holds a non-NULL if1 on this
> > failure path and jumps to free_if1, where rtw_sdio_if1_deinit() invokes
> > rtw_free_drv_sw() and rtw_free_netdev() again on the same already-freed
> > objects, resulting in a double free / use-after-free.
> > 
> > Drop the freeing from error_register_netdev and let rtw_sdio_if1_deinit()
> > perform the tear-down, which is the single owner for this path.
> > 
> > Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
> > Signed-off-by: Yi Cong <yicong@xxxxxxxxxx>
>
> You forgot to use the proper "Assisted-by:" tags for this series, right?
>

Thank you for the reminder.
I have added the "Assisted-by:" tag in Patch v3.

Regards,
    Yi Cong