lib/test_kmod.c: potential double free in error handling

Dan Carpenter · torvalds · commit db7ddeab3ce5 · 2019-02-01T15:46:23.000-08:00
There is a copy and paste bug so we set "config->test_driver" to NULL twice instead of setting "config->test_fs". Smatch complains that it leads to a double free: lib/test_kmod.c:840 __kmod_config_init() warn: 'config->test_fs' double freed Link: http://lkml.kernel.org/r/20190121140011.GA14283@kadam Fixes: d9c6a72 ("kmod: add test driver to stress test the module loader") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Luis Chamberlain <mcgrof@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
diff --git a/lib/test_kmod.c b/lib/test_kmod.c
@@ -632,7 +632,7 @@ static void __kmod_config_free(struct test_config *config)
 	config->test_driver = NULL;
 
 	kfree_const(config->test_fs);
-	config->test_driver = NULL;
+	config->test_fs = NULL;
 }
 
 static void kmod_config_free(struct kmod_test_device *test_dev)

Original file line number	Diff line number	Diff line change
`@@ -632,7 +632,7 @@ static void __kmod_config_free(struct test_config *config)`
`632`	`632`	`config->test_driver = NULL;`
`633`	`633`
`634`	`634`	`kfree_const(config->test_fs);`
`635`		`- config->test_driver = NULL;`
	`635`	`+ config->test_fs = NULL;`
`636`	`636`	`}`
`637`	`637`
`638`	`638`	`static void kmod_config_free(struct kmod_test_device *test_dev)`