linux-hwmon.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] hwmon: (core) Add comment describing how hwdev is freed in error path
@ 2019-06-06 16:59 Guenter Roeck
  0 siblings, 0 replies; only message in thread
From: Guenter Roeck @ 2019-06-06 16:59 UTC (permalink / raw)
  To: Hardware Monitoring; +Cc: Jean Delvare, Guenter Roeck, Eduardo Valentin

The hwmon core registers the hwmon device before adding sensors to the
thermal core. If that fails, the hwmon device is released and an error
is returned to the caller. From the code flow, it appears to be necessary
to free struct hwmon_device *, allocated with kzalloc(), in that
situation. This is incorrect, since the data structure will be freed
automatically in hwmon_dev_release() when device_unregister() is called.
This used to result in a double free, which was found and fixed with
commit 74e3512731bd ("hwmon: (core) Fix double-free in
__hwmon_device_register()"). This is, however, not obvious; any reader
may erroneously conclude that the data structure is not freed.

Add comment explaining why kfree() is not necessary in this situation.

Reported-by: Eduardo Valentin <eduval@amazon.com>
Cc: Eduardo Valentin <eduval@amazon.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
 drivers/hwmon/hwmon.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
index 429784edd5ff..d0f821bf8ab6 100644
--- a/drivers/hwmon/hwmon.c
+++ b/drivers/hwmon/hwmon.c
@@ -654,6 +654,12 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
 								hwdev, j);
 					if (err) {
 						device_unregister(hdev);
+						/*
+						 * Don't worry about hwdev;
+						 * hwmon_dev_release(), called
+						 * from device_unregister(),
+						 * will free it.
+						 */
 						goto ida_remove;
 					}
 				}
-- 
2.7.4


^ permalink raw reply related	[flat|nested] only message in thread

only message in thread, other threads:[~2019-06-06 16:59 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-06 16:59 [PATCH] hwmon: (core) Add comment describing how hwdev is freed in error path Guenter Roeck

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).