If device_add() fails after device_initialize(), the error path calls
put_device(&devcd->devcd_dev). This may drop the last reference to the
device and invoke devcd_dev_release(), which frees the coredump data,
drops the module reference and frees the devcd entry.
The error path then falls through to put_module and free, causing the
module reference and the coredump data to be released a second time.
Return after put_device() in this path since the device release callback
has already taken care of the resources owned by the devcd entry.
This issue was found by a static analysis tool I am developing.
Fixes: 833c95456a70 ("device coredump: add new device coredump class")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
drivers/base/devcoredump.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/base/devcoredump.c b/drivers/base/devcoredump.c
index 7e4a491bf15e..cdefdc8e83eb 100644
--- a/drivers/base/devcoredump.c
+++ b/drivers/base/devcoredump.c
@@ -437,6 +437,7 @@ void dev_coredumpm_timeout(struct device *dev, struct module *owner,
mutex_unlock(&devcd->mutex);
cancel_delayed_work_sync(&devcd->del_wk);
put_device(&devcd->devcd_dev);
+ return;
put_module:
module_put(owner);
--
2.43.0