Commit 086c6cbc authored by Yongzhi Liu's avatar Yongzhi Liu Committed by Greg Kroah-Hartman
Browse files

misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe() 



When auxiliary_device_add() returns error and then calls
auxiliary_device_uninit(), callback function
gp_auxiliary_device_release() calls ida_free() and
kfree(aux_device_wrapper) to free memory. We should't
call them again in the error handling path.

Fix this by skipping the redundant cleanup functions.

Fixes: 393fc2f5 ("misc: microchip: pci1xxxx: load auxiliary bus driver for the PIO function in the multi-function endpoint of pci1xxxx device.")
Signed-off-by: default avatarYongzhi Liu <hyperlyzcs@gmail.com>
Link: https://lore.kernel.org/r/20240523121434.21855-3-hyperlyzcs@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 73fedc31

drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gp.c

+3 −0
Original line number Diff line number Diff line
@@ -111,6 +111,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id 


err_aux_dev_add_1:

	auxiliary_device_uninit(&aux_bus->aux_device_wrapper[1]->aux_dev);

	goto err_aux_dev_add_0;



err_aux_dev_init_1:

	ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[1]->aux_dev.id);
@@ -120,6 +121,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id 


err_aux_dev_add_0:

	auxiliary_device_uninit(&aux_bus->aux_device_wrapper[0]->aux_dev);

	goto err_ret;



err_aux_dev_init_0:

	ida_free(&gp_client_ida, aux_bus->aux_device_wrapper[0]->aux_dev.id);
@@ -127,6 +129,7 @@ static int gp_aux_bus_probe(struct pci_dev *pdev, const struct pci_device_id *id 
err_ida_alloc_0:

	kfree(aux_bus->aux_device_wrapper[0]);



err_ret:

	return retval;

}