This is a note to let you know that I've just added the patch titled ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ipack-carriers-tpci200-fix-a-double-free-in-tpci200_pci_probe.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 9272e5d0028d45a3b45b58c9255e6e0df53f7ad9 Mon Sep 17 00:00:00 2001 From: Lv Yunlong <lyl2019@xxxxxxxxxxxxxxxx> Date: Mon, 24 May 2021 02:32:05 -0700 Subject: ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe From: Lv Yunlong <lyl2019@xxxxxxxxxxxxxxxx> commit 9272e5d0028d45a3b45b58c9255e6e0df53f7ad9 upstream. In the out_err_bus_register error branch of tpci200_pci_probe, tpci200->info->cfg_regs is freed by tpci200_uninstall()-> tpci200_unregister()->pci_iounmap(..,tpci200->info->cfg_regs) in the first time. But later, iounmap() is called to free tpci200->info->cfg_regs again. My patch sets tpci200->info->cfg_regs to NULL after tpci200_uninstall() to avoid the double free. Fixes: cea2f7cdff2af ("Staging: ipack/bridges/tpci200: Use the TPCI200 in big endian mode") Cc: stable <stable@xxxxxxxxxxxxxxx> Acked-by: Samuel Iglesias Gonsalvez <siglesias@xxxxxxxxxx> Signed-off-by: Lv Yunlong <lyl2019@xxxxxxxxxxxxxxxx> Link: https://lore.kernel.org/r/20210524093205.8333-1-lyl2019@xxxxxxxxxxxxxxxx Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/ipack/carriers/tpci200.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/ipack/carriers/tpci200.c +++ b/drivers/ipack/carriers/tpci200.c @@ -591,8 +591,11 @@ static int tpci200_pci_probe(struct pci_ out_err_bus_register: tpci200_uninstall(tpci200); + /* tpci200->info->cfg_regs is unmapped in tpci200_uninstall */ + tpci200->info->cfg_regs = NULL; out_err_install: - iounmap(tpci200->info->cfg_regs); + if (tpci200->info->cfg_regs) + iounmap(tpci200->info->cfg_regs); out_err_ioremap: pci_release_region(pdev, TPCI200_CFG_MEM_BAR); out_err_pci_request: Patches currently in stable-queue which might be from lyl2019@xxxxxxxxxxxxxxxx are queue-4.4/ipack-carriers-tpci200-fix-a-double-free-in-tpci200_pci_probe.patch queue-4.4/media-v4l2-core-avoid-the-dangling-pointer-in-v4l2_f.patch