Re: [PATCH v2] drivers/base/node: Handle error properly in register_one_node()

[Donet Tom <donettom@linux.ibm.com>]

On 9/17/25 7:15 PM, Chris Mason wrote:
> On Fri, 22 Aug 2025 14:18:45 +0530 Donet Tom <donettom@linux.ibm.com> wrote:
>
>> If register_node() returns an error, it is not handled correctly.
>> The function will proceed further and try to register CPUs under the
>> node, which is not correct.
>>
>> So, in this patch, if register_node() returns an error, we return
>> immediately from the function.
>>
>> Fixes: 76b67ed9dce6 ("[PATCH] node hotplug: register cpu: remove node struct")
>> Signed-off-by: Donet Tom <donettom@linux.ibm.com>
>> ---
>> v1 -> v2
>> Made the changes based on Oscar’s review comments.
>>
>> v1 - https://lore.kernel.org/all/20250702112856.295176-1-donettom@linux.ibm.com/
>> ---
>>   drivers/base/node.c | 5 +++++
>>   1 file changed, 5 insertions(+)
>>
>> diff --git a/drivers/base/node.c b/drivers/base/node.c
>> index c65b4917794e..1608816de67f 100644
>> --- a/drivers/base/node.c
>> +++ b/drivers/base/node.c
>> @@ -883,6 +883,11 @@ int register_one_node(int nid)
>>   	node_devices[nid] = node;
>>   
>>   	error = register_node(node_devices[nid], nid);
>> +	if (error) {
>> +		node_devices[nid] = NULL;
>> +		kfree(node);
>> +		return error;
>> +	}
> Can this cause a double-free? Looking at register_node(), when
> device_register() fails, it calls put_device(&node->dev). The put_device()
> call triggers node_device_release() which does kfree(to_node(dev)), freeing
> the entire node structure. So when register_node() returns an error, the
> node memory is already freed, but this code calls kfree(node) again on the
> same memory.
>
> The call chain is: register_node()->device_register() fails->
> put_device()->node_device_release()->kfree(to_node(dev)).


Thank you for pointing this out. I will address it and send a v3.


>
> [ This came from automated patch review, but it looks real to me ]
>
> -chris
>