Patch "EDAC/igen6: Avoid segmentation fault on module unload" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    EDAC/igen6: Avoid segmentation fault on module unload

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     edac-igen6-avoid-segmentation-fault-on-module-unload.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ddb9ec118812b8ffae285bc2bbbbc0c7ccec4f2b
Author: Orange Kao <orange@xxxxxxxx>
Date:   Mon Nov 4 12:40:52 2024 +0000

    EDAC/igen6: Avoid segmentation fault on module unload
    
    [ Upstream commit fefaae90398d38a1100ccd73b46ab55ff4610fba ]
    
    The segmentation fault happens because:
    
    During modprobe:
    1. In igen6_probe(), igen6_pvt will be allocated with kzalloc()
    2. In igen6_register_mci(), mci->pvt_info will point to
       &igen6_pvt->imc[mc]
    
    During rmmod:
    1. In mci_release() in edac_mc.c, it will kfree(mci->pvt_info)
    2. In igen6_remove(), it will kfree(igen6_pvt);
    
    Fix this issue by setting mci->pvt_info to NULL to avoid the double
    kfree.
    
    Fixes: 10590a9d4f23 ("EDAC/igen6: Add EDAC driver for Intel client SoCs using IBECC")
    Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219360
    Signed-off-by: Orange Kao <orange@xxxxxxxx>
    Signed-off-by: Tony Luck <tony.luck@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20241104124237.124109-2-orange@xxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c
index 74c5aad1f6081..0ab8642c4e55a 100644
--- a/drivers/edac/igen6_edac.c
+++ b/drivers/edac/igen6_edac.c
@@ -1075,6 +1075,7 @@ static int igen6_register_mci(int mc, u64 mchbar, struct pci_dev *pdev)
 	imc->mci = mci;
 	return 0;
 fail3:
+	mci->pvt_info = NULL;
 	kfree(mci->ctl_name);
 fail2:
 	edac_mc_free(mci);
@@ -1099,6 +1100,7 @@ static void igen6_unregister_mcis(void)
 
 		edac_mc_del_mc(mci->pdev);
 		kfree(mci->ctl_name);
+		mci->pvt_info = NULL;
 		edac_mc_free(mci);
 		iounmap(imc->window);
 	}