releases/3.18.71/driver-core-bus-fix-a-potential-double-free.patch

   1 From 0f9b011d3321ca1079c7a46c18cb1956fbdb7bcb Mon Sep 17 00:00:00 2001
   2 From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
   3 Date: Tue, 29 Aug 2017 21:23:49 +0200
   4 Subject: driver core: bus: Fix a potential double free
   5
   6 From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
   7
   8 commit 0f9b011d3321ca1079c7a46c18cb1956fbdb7bcb upstream.
   9
  10 The .release function of driver_ktype is 'driver_release()'.
  11 This function frees the container_of this kobject.
  12
  13 So, this memory must not be freed explicitly in the error handling path of
  14 'bus_add_driver()'. Otherwise a double free will occur.
  15
  16 Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
  17 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  18
  19 ---
  20  drivers/base/bus.c |    2 +-
  21  1 file changed, 1 insertion(+), 1 deletion(-)
  22
  23 --- a/drivers/base/bus.c
  24 +++ b/drivers/base/bus.c
  25 @@ -722,7 +722,7 @@ int bus_add_driver(struct device_driver
  26
  27  out_unregister:
  28         kobject_put(&priv->kobj);
  29 -       kfree(drv->p);
  30 +       /* drv->p is freed in driver_release()  */
  31         drv->p = NULL;
  32  out_put_bus:
  33         bus_put(bus);