linux-kernel - Re: [PATCH v2] drivers/base/node: Handle error properly in register_one

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <676712d1-7b4f-4614-bd82-5b0c43881865@linux.ibm.com>
Date: Wed, 17 Sep 2025 20:25:48 +0530
From: Donet Tom <donettom@...ux.ibm.com>
To: Chris Mason <clm@...a.com>
Cc: David Hildenbrand <david@...hat.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Oscar Salvador
 <osalvador@...e.de>, Zi Yan <ziy@...dia.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Ritesh Harjani <ritesh.list@...il.com>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, "Rafael J . Wysocki" <rafael@...nel.org>,
        Danilo Krummrich <dakr@...nel.org>,
        Jonathan Cameron <Jonathan.Cameron@...wei.com>,
        Alison Schofield <alison.schofield@...el.com>,
        Yury Norov <yury.norov@...il.com>, Dave Jiang <dave.jiang@...el.com>,
        KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>
Subject: Re: [PATCH v2] drivers/base/node: Handle error properly in
 register_one_node()


On 9/17/25 7:15 PM, Chris Mason wrote:
> On Fri, 22 Aug 2025 14:18:45 +0530 Donet Tom <donettom@...ux.ibm.com> wrote:
>
>> If register_node() returns an error, it is not handled correctly.
>> The function will proceed further and try to register CPUs under the
>> node, which is not correct.
>>
>> So, in this patch, if register_node() returns an error, we return
>> immediately from the function.
>>
>> Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
>> Signed-off-by: Donet Tom <donettom@...ux.ibm.com>
>> ---
>> v1 -> v2
>> Made the changes based on Oscar’s review comments.
>>
>> v1 - https://lore.kernel.org/all/20250702112856.295176-1-donettom@linux.ibm.com/
>> ---
>>   drivers/base/node.c | 5 +++++
>>   1 file changed, 5 insertions(+)
>>
>> diff --git a/drivers/base/node.c b/drivers/base/node.c
>> index c65b4917794e..1608816de67f 100644
>> --- a/drivers/base/node.c
>> +++ b/drivers/base/node.c
>> @@ -883,6 +883,11 @@ int register_one_node(int nid)
>>   	node_devices[nid] = node;
>>   
>>   	error = register_node(node_devices[nid], nid);
>> +	if (error) {
>> +		node_devices[nid] = NULL;
>> +		kfree(node);
>> +		return error;
>> +	}
> Can this cause a double-free? Looking at register_node(), when
> device_register() fails, it calls put_device(&node->dev). The put_device()
> call triggers node_device_release() which does kfree(to_node(dev)), freeing
> the entire node structure. So when register_node() returns an error, the
> node memory is already freed, but this code calls kfree(node) again on the
> same memory.
>
> The call chain is: register_node()->device_register() fails->
> put_device()->node_device_release()->kfree(to_node(dev)).


Thank you for pointing this out. I will address it and send a v3.


>
> [ This came from automated patch review, but it looks real to me ]
>
> -chris
>