github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

regmap: fix potential double-free of map->reg_defaults on cache reinit

Browse Source 
regcache_exit() frees map->reg_defaults but does not NULL the pointer.
If regmap_reinit_cache() is later called with a config that has neither
reg_defaults nor num_reg_defaults_raw, regcache_init() skips both
allocation branches and leaves the stale pointer in place.  Should
cache_ops->init then fail, the err_free_reg_defaults error path calls
kfree(map->reg_defaults) a second time.

NULL the pointer after freeing so the error-path kfree() is a harmless
no-op.

Assisted-by: LLM
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Link: https://patch.msgid.link/20261002-regmap-lock-2nd-v2-5-e172b0501c52@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Peng Fan 2026-10-02 21:11:21 +08:00 committed by Mark Brown
parent 8a889c83e4
commit ca685a42b0
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/base/regmap/regcache.c
View File

@ -294,6 +294,7 @@ void regcache_exit(struct regmap *map)
regcache_locked_exit(map);
kfree(map->reg_defaults);
map->reg_defaults = NULL;
}
/**