serial: core: don't kfree device managed data
authorDan Carpenter <dan.carpenter@linaro.org>
Tue, 6 Jun 2023 08:26:25 +0000 (11:26 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 6 Jun 2023 12:46:35 +0000 (14:46 +0200)
The put_device() function will call serial_base_ctrl_release() or
serial_base_port_release() so these kfrees() are a double free bug.

Fixes: 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Tony Lindgren <tony@atomide.com>
Message-ID: <ZH7tsTmWY5b/4m+6@moroto>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/tty/serial/serial_base_bus.c

index 9354af7c11af0ad8ad2f62fbcf9c72fdedac245f..9de9f6fa6481fe2f15d3e62ed0ec251fe44228fc 100644 (file)
@@ -98,7 +98,7 @@ struct serial_ctrl_device *serial_base_ctrl_add(struct uart_port *port,
                                      serial_base_ctrl_release,
                                      port->ctrl_id);
        if (err)
-               goto err_free_ctrl_dev;
+               goto err_put_device;
 
        err = device_add(&ctrl_dev->dev);
        if (err)
@@ -108,8 +108,6 @@ struct serial_ctrl_device *serial_base_ctrl_add(struct uart_port *port,
 
 err_put_device:
        put_device(&ctrl_dev->dev);
-err_free_ctrl_dev:
-       kfree(ctrl_dev);
 
        return ERR_PTR(err);
 }
@@ -140,7 +138,7 @@ struct serial_port_device *serial_base_port_add(struct uart_port *port,
                                      serial_base_port_release,
                                      port->line);
        if (err)
-               goto err_free_port_dev;
+               goto err_put_device;
 
        port_dev->port = port;
 
@@ -152,8 +150,6 @@ struct serial_port_device *serial_base_port_add(struct uart_port *port,
 
 err_put_device:
        put_device(&port_dev->dev);
-err_free_port_dev:
-       kfree(port_dev);
 
        return ERR_PTR(err);
 }