6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Donggeun Yoo [ Upstream commit 624ee129620a054466b6a29d98cd7a40ccc239cd ] When a DOE feature is reported twice, sysfs_add_file_to_group() fails with -EEXIST for the second copy and pci_doe_sysfs_feature_populate() frees that attribute's name, but leaves the pointer in place. pci_doe_sysfs_feature_remove() frees every name again when the device is removed, or when a later feature fails to register, so the name is freed twice: BUG: KASAN: double-free in pci_doe_sysfs_feature_remove+0x117/0x1b0 Call Trace: kfree+0x11a/0x420 pci_doe_sysfs_feature_remove+0x117/0x1b0 pci_doe_sysfs_teardown+0x90/0xf0 pci_remove_bus_device+0x128/0x2e0 pci_stop_and_remove_bus_device_locked+0x1d/0x30 remove_store+0xd2/0xf0 Clear the pointer after freeing the name. Fixes: 2311ab1820fe ("PCI/DOE: Expose DOE features via sysfs") Suggested-by: Alistair Francis Assisted-by: LLM Signed-off-by: Donggeun Yoo Signed-off-by: Bjorn Helgaas Reviewed-by: Alistair Francis Reviewed-by: Jonathan Cameron Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261003102221.59894-1-donggeunyoo.kernel@gmail.com Signed-off-by: Sasha Levin --- drivers/pci/doe.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/pci/doe.c b/drivers/pci/doe.c index aae9a8a00406e..3b0cc6db4402d 100644 --- a/drivers/pci/doe.c +++ b/drivers/pci/doe.c @@ -210,8 +210,9 @@ static int pci_doe_sysfs_feature_populate(struct pci_dev *pdev, pci_warn(pdev, "Failed adding %s to sysfs group\n", attrs[i].attr.name); goto fail; - } else - kfree(attrs[i].attr.name); + } + kfree(attrs[i].attr.name); + attrs[i].attr.name = NULL; } } -- 2.53.0