If edac_mc_add_mc_with_groups() fails, init_one_instance() calls edac_mc_free(), which frees mci->pvt_info. probe_one_instance() then accesses and frees the same private data, causing a use-after-free and a double free. Clear mci->pvt_info before calling edac_mc_free() to leave the cleanup to probe_one_instance(). The normal remove path already clears it. Fixes: 0bbb265f7089 ("EDAC/mc: Get rid of silly one-shot struct allocation in edac_mc_alloc()") Cc: stable@vger.kernel.org Reported-by: Qinyun Tan Signed-off-by: Weilin Tong --- drivers/edac/amd64_edac.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c index 0c0d11c72925..edced7cbe83f 100644 --- a/drivers/edac/amd64_edac.c +++ b/drivers/edac/amd64_edac.c @@ -3975,6 +3975,7 @@ static int init_one_instance(struct amd64_pvt *pvt) ret = -ENODEV; if (edac_mc_add_mc_with_groups(mci, amd64_edac_attr_groups)) { edac_dbg(1, "failed edac_mc_add_mc()\n"); + mci->pvt_info = NULL; edac_mc_free(mci); return ret; } base-commit: 2c455ddca7827ad8fa3a64fdbf5a60efb928b46a -- 2.43.5