On Sun, 19 Jan 2025, Ma Ke wrote:

When device_register(&child->dev) failed, calling put_device() to explicitly release child->dev. Otherwise, it could cause double free problem.

While the code fix seem okay, this double free part in the problem description isn't. The reference is held w/o this fix so it's not getting freed at all, let alone freed twice.

device_register() includes device_add(). As comment of device_add() says, 'if device_add() succeeds, you should call device_del() when you want to get rid of it. If device_add() has not succeeded, use only put_device() to drop the reference count'.

Found by code review.

Cc: stable@vger.kernel.org Fixes: 4f535093cf8f ("PCI: Put pci_dev in device tree as early as possible") Signed-off-by: Ma Ke make24@iscas.ac.cn

---

Changes in v2:

• added the bug description about the comment of device_add();
• fixed the patch as suggestions;
• added Cc and Fixes table.

---

drivers/pci/probe.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c index 2e81ab0f5a25..ae12f92c6a9d 100644 --- a/drivers/pci/probe.c +++ b/drivers/pci/probe.c @@ -1174,7 +1174,10 @@ static struct pci_bus *pci_alloc_child_bus(struct pci_bus *parent, add_dev: pci_set_bus_msi_domain(child); ret = device_register(&child->dev);

• WARN_ON(ret < 0);

• if (WARN_ON(ret < 0)) {

• put_device(&child->dev);
  

• return NULL;
  

• }

pcibios_add_bus(child);