linux-kernel - [PATCH 1/1] mcb: fix a double free bug in chameleon_parse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6201d09e2975ae5789879f79a6de4c38de9edd4a.1741596225.git.jth@kernel.org>
Date: Mon, 10 Mar 2025 09:46:57 +0100
From: Johannes Thumshirn <jth@...nel.org>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: linux-kernel@...r.kernel.org,
	Haoxiang Li <haoxiang_li2024@....com>,
	stable@...r.kernel.org,
	Johannes Thumshirn <jth@...nel.org>
Subject: [PATCH 1/1] mcb: fix a double free bug in chameleon_parse_gdd()

From: Haoxiang Li <haoxiang_li2024@....com>

In chameleon_parse_gdd(), if mcb_device_register() fails, 'mdev'
would be released in mcb_device_register() via put_device().
Thus, goto 'err' label and free 'mdev' again causes a double free.
Just return if mcb_device_register() fails.

Fixes: 3764e82e5150 ("drivers: Introduce MEN Chameleon Bus")
Cc: stable@...r.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@....com>
Signed-off-by: Johannes Thumshirn <jth@...nel.org>
---
 drivers/mcb/mcb-parse.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
index 02a680c73979..bf0d7d58c8b0 100644
--- a/drivers/mcb/mcb-parse.c
+++ b/drivers/mcb/mcb-parse.c
@@ -96,7 +96,7 @@ static int chameleon_parse_gdd(struct mcb_bus *bus,
 
 	ret = mcb_device_register(bus, mdev);
 	if (ret < 0)
-		goto err;
+		return ret;
 
 	return 0;
 
-- 
2.43.0