memstick: fix a double-free bug in memstick_check
authorQinglang Miao <miaoqinglang@huawei.com>
Fri, 20 Nov 2020 07:48:46 +0000 (15:48 +0800)
committerUlf Hansson <ulf.hansson@linaro.org>
Tue, 24 Nov 2020 10:26:55 +0000 (11:26 +0100)
kfree(host->card) has been called in put_device so that
another kfree would raise cause a double-free bug.

Fixes: 0193383a5833 ("memstick: core: fix device_register() error handling")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Link: https://lore.kernel.org/r/20201120074846.31322-1-miaoqinglang@huawei.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
drivers/memstick/core/memstick.c

index ef03d6fafc5ce8a3d9a6b324264de0ae89a75832..12bc3f5a6cbbd594c56013526b973659d0defe9a 100644 (file)
@@ -468,7 +468,6 @@ static void memstick_check(struct work_struct *work)
                        host->card = card;
                        if (device_register(&card->dev)) {
                                put_device(&card->dev);
-                               kfree(host->card);
                                host->card = NULL;
                        }
                } else