All of lore.kernel.org
 help / color / mirror / Atom feed
* [saeed:testing/net-next-mlx5 1/12] drivers/net/ethernet/mellanox/mlx5/core/steering/dr_buddy.c:87 mlx5dr_buddy_init() error: double free of 'buddy->bitmap_per_long'
@ 2020-10-27 13:24 ` Dan Carpenter
  0 siblings, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2020-10-27 13:24 UTC (permalink / raw)
  To: kbuild

[-- Attachment #1: Type: text/plain, Size: 6403 bytes --]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux.git testing/net-next-mlx5
head:   40274b1f61191eb677894fb2c9a0a45ce45bdda2
commit: ba35ec2c6bfb48ec81b09ce2bd440190f2848aa1 [1/12] net/mlx5: DR, Add buddy allocator utilities
config: x86_64-randconfig-m001-20201027 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

smatch warnings:
drivers/net/ethernet/mellanox/mlx5/core/steering/dr_buddy.c:87 mlx5dr_buddy_init() error: double free of 'buddy->bitmap_per_long'

vim +87 drivers/net/ethernet/mellanox/mlx5/core/steering/dr_buddy.c

ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  23  int mlx5dr_buddy_init(struct mlx5dr_icm_buddy_mem *buddy,
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  24  		      unsigned int max_order)
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  25  {
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  26  	int i;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  27  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  28  	buddy->max_order = max_order;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  29  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  30  	INIT_LIST_HEAD(&buddy->list_node);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  31  	INIT_LIST_HEAD(&buddy->used_list);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  32  	INIT_LIST_HEAD(&buddy->hot_list);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  33  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  34  	buddy->bitmap = kcalloc(buddy->max_order + 1,
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  35  				sizeof(*buddy->bitmap),
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  36  				GFP_KERNEL);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  37  	buddy->num_free = kcalloc(buddy->max_order + 1,
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  38  				  sizeof(*buddy->num_free),
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  39  				  GFP_KERNEL);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  40  	buddy->bitmap_per_long = kcalloc(buddy->max_order + 1,
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  41  					 sizeof(*buddy->bitmap_per_long),
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  42  					 GFP_KERNEL);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  43  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  44  	if (!buddy->bitmap || !buddy->num_free || !buddy->bitmap_per_long)
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  45  		goto err_free_all;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  46  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  47  	/* Allocating max_order bitmaps, one for each order */
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  48  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  49  	for (i = 0; i <= buddy->max_order; ++i) {
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  50  		unsigned int size = 1 << (buddy->max_order - i);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  51  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  52  		buddy->bitmap[i] = bitmap_zalloc(size, GFP_KERNEL);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  53  		if (!buddy->bitmap[i])
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  54  			goto err_out_free_each_bit_per_order;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  55  	}
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  56  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  57  	for (i = 0; i <= buddy->max_order; ++i) {
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  58  		unsigned int size = BITS_TO_LONGS(1 << (buddy->max_order - i));
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  59  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  60  		buddy->bitmap_per_long[i] = bitmap_zalloc(size, GFP_KERNEL);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  61  		if (!buddy->bitmap_per_long[i])
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  62  			goto err_out_free_set;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  63  	}
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  64  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  65  	/* In the beginning, we have only one order that is available for
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  66  	 * use (the biggest one), so mark the first bit in both bitmaps.
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  67  	 */
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  68  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  69  	bitmap_set(buddy->bitmap[buddy->max_order], 0, 1);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  70  	bitmap_set(buddy->bitmap_per_long[buddy->max_order], 0, 1);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  71  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  72  	buddy->num_free[buddy->max_order] = 1;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  73  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  74  	return 0;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  75  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  76  err_out_free_set:
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  77  	for (i = 0; i <= buddy->max_order; ++i)
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  78  		bitmap_free(buddy->bitmap_per_long[i]);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  79  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  80  err_out_free_each_bit_per_order:
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  81  	kfree(buddy->bitmap_per_long);
                                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Delete this.

ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  82  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  83  	for (i = 0; i <= buddy->max_order; ++i)
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  84  		bitmap_free(buddy->bitmap[i]);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  85  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  86  err_free_all:
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14 @87  	kfree(buddy->bitmap_per_long);
                                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Leave this one.

ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  88  	kfree(buddy->num_free);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  89  	kfree(buddy->bitmap);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  90  	return -ENOMEM;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  91  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 36707 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread
* [saeed:testing/net-next-mlx5 1/12] drivers/net/ethernet/mellanox/mlx5/core/steering/dr_buddy.c:87 mlx5dr_buddy_init() error: double free of 'buddy->bitmap_per_long'
@ 2020-10-27 13:05 kernel test robot
  0 siblings, 0 replies; 3+ messages in thread
From: kernel test robot @ 2020-10-27 13:05 UTC (permalink / raw)
  To: kbuild

[-- Attachment #1: Type: text/plain, Size: 6555 bytes --]

CC: kbuild-all(a)lists.01.org
TO: Yevgeny Kliteynik <kliteyn@nvidia.com>
CC: Saeed Mahameed <saeedm@nvidia.com>
CC: Erez Shitrit <erezsh@nvidia.com>
CC: Mark Bloch <mbloch@nvidia.com>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux.git testing/net-next-mlx5
head:   40274b1f61191eb677894fb2c9a0a45ce45bdda2
commit: ba35ec2c6bfb48ec81b09ce2bd440190f2848aa1 [1/12] net/mlx5: DR, Add buddy allocator utilities
:::::: branch date: 7 hours ago
:::::: commit date: 7 hours ago
config: x86_64-randconfig-m001-20201027 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

smatch warnings:
drivers/net/ethernet/mellanox/mlx5/core/steering/dr_buddy.c:87 mlx5dr_buddy_init() error: double free of 'buddy->bitmap_per_long'

vim +87 drivers/net/ethernet/mellanox/mlx5/core/steering/dr_buddy.c

ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  22  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  23  int mlx5dr_buddy_init(struct mlx5dr_icm_buddy_mem *buddy,
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  24  		      unsigned int max_order)
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  25  {
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  26  	int i;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  27  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  28  	buddy->max_order = max_order;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  29  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  30  	INIT_LIST_HEAD(&buddy->list_node);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  31  	INIT_LIST_HEAD(&buddy->used_list);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  32  	INIT_LIST_HEAD(&buddy->hot_list);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  33  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  34  	buddy->bitmap = kcalloc(buddy->max_order + 1,
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  35  				sizeof(*buddy->bitmap),
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  36  				GFP_KERNEL);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  37  	buddy->num_free = kcalloc(buddy->max_order + 1,
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  38  				  sizeof(*buddy->num_free),
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  39  				  GFP_KERNEL);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  40  	buddy->bitmap_per_long = kcalloc(buddy->max_order + 1,
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  41  					 sizeof(*buddy->bitmap_per_long),
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  42  					 GFP_KERNEL);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  43  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  44  	if (!buddy->bitmap || !buddy->num_free || !buddy->bitmap_per_long)
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  45  		goto err_free_all;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  46  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  47  	/* Allocating max_order bitmaps, one for each order */
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  48  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  49  	for (i = 0; i <= buddy->max_order; ++i) {
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  50  		unsigned int size = 1 << (buddy->max_order - i);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  51  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  52  		buddy->bitmap[i] = bitmap_zalloc(size, GFP_KERNEL);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  53  		if (!buddy->bitmap[i])
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  54  			goto err_out_free_each_bit_per_order;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  55  	}
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  56  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  57  	for (i = 0; i <= buddy->max_order; ++i) {
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  58  		unsigned int size = BITS_TO_LONGS(1 << (buddy->max_order - i));
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  59  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  60  		buddy->bitmap_per_long[i] = bitmap_zalloc(size, GFP_KERNEL);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  61  		if (!buddy->bitmap_per_long[i])
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  62  			goto err_out_free_set;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  63  	}
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  64  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  65  	/* In the beginning, we have only one order that is available for
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  66  	 * use (the biggest one), so mark the first bit in both bitmaps.
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  67  	 */
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  68  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  69  	bitmap_set(buddy->bitmap[buddy->max_order], 0, 1);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  70  	bitmap_set(buddy->bitmap_per_long[buddy->max_order], 0, 1);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  71  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  72  	buddy->num_free[buddy->max_order] = 1;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  73  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  74  	return 0;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  75  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  76  err_out_free_set:
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  77  	for (i = 0; i <= buddy->max_order; ++i)
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  78  		bitmap_free(buddy->bitmap_per_long[i]);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  79  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  80  err_out_free_each_bit_per_order:
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  81  	kfree(buddy->bitmap_per_long);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  82  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  83  	for (i = 0; i <= buddy->max_order; ++i)
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  84  		bitmap_free(buddy->bitmap[i]);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  85  
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  86  err_free_all:
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14 @87  	kfree(buddy->bitmap_per_long);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  88  	kfree(buddy->num_free);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  89  	kfree(buddy->bitmap);
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  90  	return -ENOMEM;
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  91  }
ba35ec2c6bfb48e Yevgeny Kliteynik 2020-09-14  92  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 36707 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-10-27 13:24 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-10-27 13:24 [saeed:testing/net-next-mlx5 1/12] drivers/net/ethernet/mellanox/mlx5/core/steering/dr_buddy.c:87 mlx5dr_buddy_init() error: double free of 'buddy->bitmap_per_long' Dan Carpenter
2020-10-27 13:24 ` Dan Carpenter
  -- strict thread matches above, loose matches on Subject: below --
2020-10-27 13:05 kernel test robot

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.