When all references are dropped, callback function plx_dma_release() for put_device() will call kfree(plxdev) to release memory. Fix the error path to fix the possible double free. Fixes: 07503e6aefe4 ("dmaengine: plx_dma: add a missing put_device() on error path") Signed-off-by: Miaoqian Lin <linmq006@xxxxxxxxx> --- Please correct me if I make mistakes, thanks for your review. --- drivers/dma/plx_dma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/dma/plx_dma.c b/drivers/dma/plx_dma.c index 12725fa1655f..bce724ff4e16 100644 --- a/drivers/dma/plx_dma.c +++ b/drivers/dma/plx_dma.c @@ -546,8 +546,9 @@ static int plx_dma_create(struct pci_dev *pdev) return 0; put_device: - put_device(&pdev->dev); free_irq(pci_irq_vector(pdev, 0), plxdev); + put_device(&pdev->dev); + return rc; free_plx: kfree(plxdev); -- 2.25.1