diff options
| author |   Dmitry Osipenko <digetx@gmail.com> | 2020-08-18 02:50:48 +0300 |
|---|---|---|
| committer |   Lee Jones <lee.jones@linaro.org> | 2020-08-24 14:23:55 +0100 |
| commit | 6b6cf2b5debd42de39afd8ac84b60faeca62cfaf (patch) | |
| tree | f6858b75e310ea2576f4f794ff9e36db405478fc | |
| parent | Linux 5.9-rc1 (diff) | |
| download | linux-dev-6b6cf2b5debd42de39afd8ac84b60faeca62cfaf.tar.xz linux-dev-6b6cf2b5debd42de39afd8ac84b60faeca62cfaf.zip | |
mfd: core: Fix double-free in mfd_remove_devices_fn()
The pdev.mfd_cell is released by platform_device_release(), which is
invoked by platform_device_unregister(). Hence mfd_remove_devices_fn()
shouldn't release the cell variable. The double-free bug is reported KASAN
during of MFD driver module removal.
Fixes: 466a62d7642f ("mfd: core: Make a best effort attempt to match devices with the correct of_nodes")
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
| -rw-r--r-- | drivers/mfd/mfd-core.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c index c3651f06684f..c50718e3db58 100644 --- a/drivers/mfd/mfd-core.c +++ b/drivers/mfd/mfd-core.c @@ -370,8 +370,6 @@ static int mfd_remove_devices_fn(struct device *dev, void *data) regulator_bulk_unregister_supply_alias(dev, cell->parent_supplies, cell->num_parent_supplies); - kfree(cell); - platform_device_unregister(pdev); return 0; } |