Re: [PATCH v2] drivers/base/node: Handle error properly in register_one_node()

[Chris Mason <clm@meta.com>]

On Fri, 22 Aug 2025 14:18:45 +0530 Donet Tom <donettom@linux.ibm.com> wrote:

> If register_node() returns an error, it is not handled correctly.
> The function will proceed further and try to register CPUs under the
> node, which is not correct.
> 
> So, in this patch, if register_node() returns an error, we return
> immediately from the function.
> 
> Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
> Signed-off-by: Donet Tom <donettom@linux.ibm.com>
> ---
> v1 -> v2
> Made the changes based on Oscar’s review comments.
> 
> v1 - https://lore.kernel.org/all/20250702112856.295176-1-donettom@linux.ibm.com/
> ---
>  drivers/base/node.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/base/node.c b/drivers/base/node.c
> index c65b4917794e..1608816de67f 100644
> --- a/drivers/base/node.c
> +++ b/drivers/base/node.c
> @@ -883,6 +883,11 @@ int register_one_node(int nid)
>  	node_devices[nid] = node;
>  
>  	error = register_node(node_devices[nid], nid);
> +	if (error) {
> +		node_devices[nid] = NULL;
> +		kfree(node);
> +		return error;
> +	}

Can this cause a double-free? Looking at register_node(), when 
device_register() fails, it calls put_device(&node->dev). The put_device() 
call triggers node_device_release() which does kfree(to_node(dev)), freeing
the entire node structure. So when register_node() returns an error, the 
node memory is already freed, but this code calls kfree(node) again on the
same memory.

The call chain is: register_node()->device_register() fails->
put_device()->node_device_release()->kfree(to_node(dev)).

[ This came from automated patch review, but it looks real to me ]

-chris