pinctrl: keembay: fix double free in keembay_build_functions()

[PATCH next] pinctrl: keembay: fix double free in keembay_build_functions()

Posted by Dan Carpenter 4 weeks ago

This kfree() was accidentally left over when we converted to devm_
and it would lead to a double free.  Delete it.

Fixes: 995bc9f4826e ("pinctrl: keembay: release allocated memory in detach path")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
 drivers/pinctrl/pinctrl-keembay.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-keembay.c b/drivers/pinctrl/pinctrl-keembay.c
index 30122ca90cbe..3241d3ae6219 100644
--- a/drivers/pinctrl/pinctrl-keembay.c
+++ b/drivers/pinctrl/pinctrl-keembay.c
@@ -1643,10 +1643,8 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)
 	new_funcs = devm_krealloc_array(kpc->dev, keembay_funcs,
 					kpc->nfuncs, sizeof(*new_funcs),
 					GFP_KERNEL);
-	if (!new_funcs) {
-		kfree(keembay_funcs);
+	if (!new_funcs)
 		return -ENOMEM;
-	}
 
 	return keembay_add_functions(kpc, new_funcs);
 }
-- 
2.47.2

Re: [PATCH next] pinctrl: keembay: fix double free in keembay_build_functions()

Posted by Linus Walleij 4 weeks ago

On Thu, Sep 4, 2025 at 8:58 PM Dan Carpenter <dan.carpenter@linaro.org> wrote:

> This kfree() was accidentally left over when we converted to devm_
> and it would lead to a double free.  Delete it.
>
> Fixes: 995bc9f4826e ("pinctrl: keembay: release allocated memory in detach path")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>

Patch applied!

Yours,
Linus Walleij

Re: [PATCH next] pinctrl: keembay: fix double free in keembay_build_functions()

Posted by Bartosz Golaszewski 4 weeks ago

On Thu, 4 Sep 2025 20:58:54 +0200, Dan Carpenter
<dan.carpenter@linaro.org> said:
> This kfree() was accidentally left over when we converted to devm_
> and it would lead to a double free.  Delete it.
>
> Fixes: 995bc9f4826e ("pinctrl: keembay: release allocated memory in detach path")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
>  drivers/pinctrl/pinctrl-keembay.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/drivers/pinctrl/pinctrl-keembay.c b/drivers/pinctrl/pinctrl-keembay.c
> index 30122ca90cbe..3241d3ae6219 100644
> --- a/drivers/pinctrl/pinctrl-keembay.c
> +++ b/drivers/pinctrl/pinctrl-keembay.c
> @@ -1643,10 +1643,8 @@ static int keembay_build_functions(struct keembay_pinctrl *kpc)
>  	new_funcs = devm_krealloc_array(kpc->dev, keembay_funcs,
>  					kpc->nfuncs, sizeof(*new_funcs),
>  					GFP_KERNEL);
> -	if (!new_funcs) {
> -		kfree(keembay_funcs);
> +	if (!new_funcs)
>  		return -ENOMEM;
> -	}
>
>  	return keembay_add_functions(kpc, new_funcs);
>  }
> --
> 2.47.2
>

Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>