6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donet Tom donettom@linux.ibm.com
[ Upstream commit 0efdedfa537eb534c251a5b4794caaf72cc55869 ]
When device_register() fails in register_node(), it calls put_device(&node->dev). This triggers node_device_release(), which calls kfree(to_node(dev)), thereby freeing the entire node structure.
As a result, when register_node() returns an error, the node memory has already been freed. Calling kfree(node) again in register_one_node() leads to a double free.
This patch removes the redundant kfree(node) from register_one_node() to prevent the double free.
Link: https://lkml.kernel.org/r/20250918054144.58980-1-donettom@linux.ibm.com Fixes: 786eb990cfb7 ("drivers/base/node: handle error properly in register_one_node()") Signed-off-by: Donet Tom donettom@linux.ibm.com Acked-by: David Hildenbrand david@redhat.com Acked-by: Oscar Salvador osalvador@suse.de Cc: Alison Schofield alison.schofield@intel.com Cc: Chris Mason clm@meta.com Cc: Danilo Krummrich dakr@kernel.org Cc: Dave Jiang dave.jiang@intel.com Cc: Greg Kroah-Hartman gregkh@linuxfoundation.org Cc: Hiroyouki Kamezawa kamezawa.hiroyu@jp.fujitsu.com Cc: Joanthan Cameron Jonathan.Cameron@huawei.com Cc: "Ritesh Harjani (IBM)" ritesh.list@gmail.com Cc: Yury Norov (NVIDIA) yury.norov@gmail.com Cc: Zi Yan ziy@nvidia.com Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/base/node.c | 1 - 1 file changed, 1 deletion(-)
diff --git a/drivers/base/node.c b/drivers/base/node.c index cbaa4e2eddcef..6153dbd5be903 100644 --- a/drivers/base/node.c +++ b/drivers/base/node.c @@ -871,7 +871,6 @@ int __register_one_node(int nid) error = register_node(node_devices[nid], nid); if (error) { node_devices[nid] = NULL; - kfree(node); return error; }