intel_th_subdevice_alloc() hands a fully initialized device to the
driver core with device_add(). If device_add() fails, the object must be
released with put_device(), which runs intel_th_device_release() and then
intel_th_device_free().
The failure path freed thdev->resource before calling put_device(), but
intel_th_device_free() frees the same pointer from the release callback.
Leave resource ownership with the device release path and jump directly
to put_device().
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: 512592779a337 ("intel_th: Fix a double put_device() in error path")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
drivers/hwtracing/intel_th/core.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
index 3924e63e2eeeb..1d33c9e42c595 100644
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -683,7 +683,7 @@ intel_th_subdevice_alloc(struct intel_th *th,
err = device_add(&thdev->dev);
if (err)
- goto fail_free_res;
+ goto fail_put_device;
/* need switch driver to be loaded to enumerate the rest */
if (subdev->type == INTEL_TH_SWITCH && !req) {
@@ -694,9 +694,6 @@ intel_th_subdevice_alloc(struct intel_th *th,
return thdev;
-fail_free_res:
- kfree(thdev->resource);
-
fail_put_device:
put_device(&thdev->dev);
--
2.51.0