The original sequence kfree(dd); pci_set_drvdata(pdev, NULL); creates a theoretical race condition window. Between these two calls, the pci_dev structure retains a dangling pointer to the already-freed device private data (dd). Any concurrent access to the drvdata (e.g., from an interrupt handler or an unexpected call to remove) would lead to a use-after-free kernel oops. Changes made: 1. `pci_set_drvdata(pdev, NULL);` - First, atomically sever the link from the pci_dev. 2. `kfree(dd);` - Then, safely free the private memory. This ensures the kernel state is always consistent before resources are released, adhering to defensive programming principles. Signed-off-by: Zhang Heng <zhangheng@xxxxxxxxxx> --- drivers/block/mtip32xx/mtip32xx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c index 8fc7761397bd..f228363e6b1c 100644 --- a/drivers/block/mtip32xx/mtip32xx.c +++ b/drivers/block/mtip32xx/mtip32xx.c @@ -3839,9 +3839,8 @@ static int mtip_pci_probe(struct pci_dev *pdev, } iomap_err: - kfree(dd); pci_set_drvdata(pdev, NULL); - return rv; + kfree(dd); done: return rv; } -- 2.47.1
