Re: [PATCH net v2] dibs: fix double free of dmb_clientid_arr
From: Dust Li <dust.li@linux.alibaba.com>
Date: 2026-08-06 23:08:23
Also in:
linux-rdma, linux-s390, lkml
On 2026-08-06 14:04:47, Hidayath Khan wrote:
dibs_dev_add() frees dibs->dmb_clientid_arr on both of its failure
paths, but does not clear the pointer. dibs_lo_dev_probe() then frees
the same pointer again in its err_reg path, so a failing device_add()
or sysfs_create_group() results in a double free.
Drop the kfree() from dibs_lo_dev_probe().
Fixes: cc21191b584c ("dibs: Move data path to dibs layer")
Cc: stable@vger.kernel.org
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: Hidayath Khan <redacted>Reviewed-by: Dust Li <dust.li@linux.alibaba.com> Best regards, Dust