diff options
| author | Peng Fan <peng.fan@nxp.com> | 2026-10-02 21:11:21 +0800 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2026-10-06 18:08:00 +0200 |
| commit | ca685a42b0fda83037a92e3fd58763aa033c124b (patch) | |
| tree | ce2c5537ecf5db859af650f16bc7c1e65fd2baf5 /drivers/base | |
| parent | 8a889c83e478074f90335791f7d2c8e2dc5b0552 (diff) | |
| download | linux-ca685a42b0fda83037a92e3fd58763aa033c124b.tar.gz linux-ca685a42b0fda83037a92e3fd58763aa033c124b.zip | |
regmap: fix potential double-free of map->reg_defaults on cache reinit
regcache_exit() frees map->reg_defaults but does not NULL the pointer.
If regmap_reinit_cache() is later called with a config that has neither
reg_defaults nor num_reg_defaults_raw, regcache_init() skips both
allocation branches and leaves the stale pointer in place. Should
cache_ops->init then fail, the err_free_reg_defaults error path calls
kfree(map->reg_defaults) a second time.
NULL the pointer after freeing so the error-path kfree() is a harmless
no-op.
Assisted-by: LLM
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Link: https://patch.msgid.link/20261002-regmap-lock-2nd-v2-5-e172b0501c52@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'drivers/base')
| -rw-r--r-- | drivers/base/regmap/regcache.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c index 136d6adf3120..3b1c2f28d585 100644 --- a/drivers/base/regmap/regcache.c +++ b/drivers/base/regmap/regcache.c @@ -294,6 +294,7 @@ void regcache_exit(struct regmap *map) regcache_locked_exit(map); kfree(map->reg_defaults); + map->reg_defaults = NULL; } /** |