From ca685a42b0fda83037a92e3fd58763aa033c124b Mon Sep 17 00:00:00 2001 From: Peng Fan Date: Fri, 2 Oct 2026 21:11:21 +0800 Subject: [PATCH] regmap: fix potential double-free of map->reg_defaults on cache reinit regcache_exit() frees map->reg_defaults but does not NULL the pointer. If regmap_reinit_cache() is later called with a config that has neither reg_defaults nor num_reg_defaults_raw, regcache_init() skips both allocation branches and leaves the stale pointer in place. Should cache_ops->init then fail, the err_free_reg_defaults error path calls kfree(map->reg_defaults) a second time. NULL the pointer after freeing so the error-path kfree() is a harmless no-op. Assisted-by: LLM Signed-off-by: Peng Fan Link: https://patch.msgid.link/20261002-regmap-lock-2nd-v2-5-e172b0501c52@nxp.com Signed-off-by: Mark Brown --- drivers/base/regmap/regcache.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c index 136d6adf3120..3b1c2f28d585 100644 --- a/drivers/base/regmap/regcache.c +++ b/drivers/base/regmap/regcache.c @@ -294,6 +294,7 @@ void regcache_exit(struct regmap *map) regcache_locked_exit(map); kfree(map->reg_defaults); + map->reg_defaults = NULL; } /**