From 624ee129620a054466b6a29d98cd7a40ccc239cd Mon Sep 17 00:00:00 2001 From: Donggeun Yoo Date: Sat, 3 Oct 2026 19:22:21 +0900 Subject: [PATCH] PCI/DOE: Fix double free of a duplicate feature's sysfs name When a DOE feature is reported twice, sysfs_add_file_to_group() fails with -EEXIST for the second copy and pci_doe_sysfs_feature_populate() frees that attribute's name, but leaves the pointer in place. pci_doe_sysfs_feature_remove() frees every name again when the device is removed, or when a later feature fails to register, so the name is freed twice: BUG: KASAN: double-free in pci_doe_sysfs_feature_remove+0x117/0x1b0 Call Trace: kfree+0x11a/0x420 pci_doe_sysfs_feature_remove+0x117/0x1b0 pci_doe_sysfs_teardown+0x90/0xf0 pci_remove_bus_device+0x128/0x2e0 pci_stop_and_remove_bus_device_locked+0x1d/0x30 remove_store+0xd2/0xf0 Clear the pointer after freeing the name. Fixes: 2311ab1820fe ("PCI/DOE: Expose DOE features via sysfs") Suggested-by: Alistair Francis Assisted-by: LLM Signed-off-by: Donggeun Yoo Signed-off-by: Bjorn Helgaas Reviewed-by: Alistair Francis Reviewed-by: Jonathan Cameron Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261003102221.59894-1-donggeunyoo.kernel@gmail.com --- drivers/pci/doe.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/pci/doe.c b/drivers/pci/doe.c index ac95b1d2d999..6b5d9ba8e969 100644 --- a/drivers/pci/doe.c +++ b/drivers/pci/doe.c @@ -208,8 +208,9 @@ static int pci_doe_sysfs_feature_populate(struct pci_dev *pdev, pci_warn(pdev, "Failed adding %s to sysfs group\n", attrs[i].attr.name); goto fail; - } else - kfree(attrs[i].attr.name); + } + kfree(attrs[i].attr.name); + attrs[i].attr.name = NULL; } }