From: Dan Carpenter <dan.carpenter@oracle.com>
To: kbuild@lists.01.org
Subject: drivers/cpufreq/qcom-cpufreq-hw.c:377 qcom_cpufreq_hw_cpu_init() error: we previously assumed 'data' could be null (see line 327)
Date: Sat, 27 Feb 2021 12:26:20 +0300 [thread overview]
Message-ID: <20210227092620.GD2087@kadam> (raw)
[-- Attachment #1: Type: text/plain, Size: 9235 bytes --]
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 8b83369ddcb3fb9cab5c1088987ce477565bb630
commit: 67fc209b527d023db4d087c68e44e9790aa089ef cpufreq: qcom-hw: drop devm_xxx() calls from init/exit hooks
config: arm64-randconfig-m031-20210226 (attached as .config)
compiler: aarch64-linux-gcc (GCC) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
smatch warnings:
drivers/cpufreq/qcom-cpufreq-hw.c:377 qcom_cpufreq_hw_cpu_init() error: we previously assumed 'data' could be null (see line 327)
drivers/cpufreq/qcom-cpufreq-hw.c:377 qcom_cpufreq_hw_cpu_init() error: dereferencing freed memory 'data'
vim +/data +377 drivers/cpufreq/qcom-cpufreq-hw.c
2849dd8bc72b62 Taniya Das 2018-12-14 277 static int qcom_cpufreq_hw_cpu_init(struct cpufreq_policy *policy)
2849dd8bc72b62 Taniya Das 2018-12-14 278 {
bd74e286b35413 Manivannan Sadhasivam 2020-09-08 279 struct platform_device *pdev = cpufreq_get_driver_data();
bd74e286b35413 Manivannan Sadhasivam 2020-09-08 280 struct device *dev = &pdev->dev;
2849dd8bc72b62 Taniya Das 2018-12-14 281 struct of_phandle_args args;
2849dd8bc72b62 Taniya Das 2018-12-14 282 struct device_node *cpu_np;
55538fbc79e926 Taniya Das 2019-01-31 283 struct device *cpu_dev;
67fc209b527d02 Shawn Guo 2021-01-19 284 struct resource *res;
2849dd8bc72b62 Taniya Das 2018-12-14 285 void __iomem *base;
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 286 struct qcom_cpufreq_data *data;
2849dd8bc72b62 Taniya Das 2018-12-14 287 int ret, index;
2849dd8bc72b62 Taniya Das 2018-12-14 288
55538fbc79e926 Taniya Das 2019-01-31 289 cpu_dev = get_cpu_device(policy->cpu);
55538fbc79e926 Taniya Das 2019-01-31 290 if (!cpu_dev) {
55538fbc79e926 Taniya Das 2019-01-31 291 pr_err("%s: failed to get cpu%d device\n", __func__,
55538fbc79e926 Taniya Das 2019-01-31 292 policy->cpu);
55538fbc79e926 Taniya Das 2019-01-31 293 return -ENODEV;
55538fbc79e926 Taniya Das 2019-01-31 294 }
55538fbc79e926 Taniya Das 2019-01-31 295
2849dd8bc72b62 Taniya Das 2018-12-14 296 cpu_np = of_cpu_device_node_get(policy->cpu);
2849dd8bc72b62 Taniya Das 2018-12-14 297 if (!cpu_np)
2849dd8bc72b62 Taniya Das 2018-12-14 298 return -EINVAL;
2849dd8bc72b62 Taniya Das 2018-12-14 299
2849dd8bc72b62 Taniya Das 2018-12-14 300 ret = of_parse_phandle_with_args(cpu_np, "qcom,freq-domain",
2849dd8bc72b62 Taniya Das 2018-12-14 301 "#freq-domain-cells", 0, &args);
2849dd8bc72b62 Taniya Das 2018-12-14 302 of_node_put(cpu_np);
2849dd8bc72b62 Taniya Das 2018-12-14 303 if (ret)
2849dd8bc72b62 Taniya Das 2018-12-14 304 return ret;
2849dd8bc72b62 Taniya Das 2018-12-14 305
2849dd8bc72b62 Taniya Das 2018-12-14 306 index = args.args[0];
2849dd8bc72b62 Taniya Das 2018-12-14 307
67fc209b527d02 Shawn Guo 2021-01-19 308 res = platform_get_resource(pdev, IORESOURCE_MEM, index);
67fc209b527d02 Shawn Guo 2021-01-19 309 if (!res) {
67fc209b527d02 Shawn Guo 2021-01-19 310 dev_err(dev, "failed to get mem resource %d\n", index);
67fc209b527d02 Shawn Guo 2021-01-19 311 return -ENODEV;
67fc209b527d02 Shawn Guo 2021-01-19 312 }
67fc209b527d02 Shawn Guo 2021-01-19 313
67fc209b527d02 Shawn Guo 2021-01-19 314 if (!request_mem_region(res->start, resource_size(res), res->name)) {
67fc209b527d02 Shawn Guo 2021-01-19 315 dev_err(dev, "failed to request resource %pR\n", res);
67fc209b527d02 Shawn Guo 2021-01-19 316 return -EBUSY;
67fc209b527d02 Shawn Guo 2021-01-19 317 }
2849dd8bc72b62 Taniya Das 2018-12-14 318
67fc209b527d02 Shawn Guo 2021-01-19 319 base = ioremap(res->start, resource_size(res));
67fc209b527d02 Shawn Guo 2021-01-19 320 if (IS_ERR(base)) {
67fc209b527d02 Shawn Guo 2021-01-19 321 dev_err(dev, "failed to map resource %pR\n", res);
67fc209b527d02 Shawn Guo 2021-01-19 322 ret = PTR_ERR(base);
67fc209b527d02 Shawn Guo 2021-01-19 323 goto release_region;
67fc209b527d02 Shawn Guo 2021-01-19 324 }
67fc209b527d02 Shawn Guo 2021-01-19 325
67fc209b527d02 Shawn Guo 2021-01-19 326 data = kzalloc(sizeof(*data), GFP_KERNEL);
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 @327 if (!data) {
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 328 ret = -ENOMEM;
67fc209b527d02 Shawn Guo 2021-01-19 329 goto unmap_base;
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 330 }
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 331
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 332 data->soc_data = of_device_get_match_data(&pdev->dev);
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 333 data->base = base;
67fc209b527d02 Shawn Guo 2021-01-19 334 data->res = res;
2849dd8bc72b62 Taniya Das 2018-12-14 335
2849dd8bc72b62 Taniya Das 2018-12-14 336 /* HW should be in enabled state to proceed */
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 337 if (!(readl_relaxed(base + data->soc_data->reg_enable) & 0x1)) {
2849dd8bc72b62 Taniya Das 2018-12-14 338 dev_err(dev, "Domain-%d cpufreq hardware not enabled\n", index);
2849dd8bc72b62 Taniya Das 2018-12-14 339 ret = -ENODEV;
2849dd8bc72b62 Taniya Das 2018-12-14 340 goto error;
2849dd8bc72b62 Taniya Das 2018-12-14 341 }
2849dd8bc72b62 Taniya Das 2018-12-14 342
2849dd8bc72b62 Taniya Das 2018-12-14 343 qcom_get_related_cpus(index, policy->cpus);
2849dd8bc72b62 Taniya Das 2018-12-14 344 if (!cpumask_weight(policy->cpus)) {
2849dd8bc72b62 Taniya Das 2018-12-14 345 dev_err(dev, "Domain-%d failed to get related CPUs\n", index);
2849dd8bc72b62 Taniya Das 2018-12-14 346 ret = -ENOENT;
2849dd8bc72b62 Taniya Das 2018-12-14 347 goto error;
2849dd8bc72b62 Taniya Das 2018-12-14 348 }
2849dd8bc72b62 Taniya Das 2018-12-14 349
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 350 policy->driver_data = data;
2849dd8bc72b62 Taniya Das 2018-12-14 351
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 352 ret = qcom_cpufreq_hw_read_lut(cpu_dev, policy);
2849dd8bc72b62 Taniya Das 2018-12-14 353 if (ret) {
2849dd8bc72b62 Taniya Das 2018-12-14 354 dev_err(dev, "Domain-%d failed to read LUT\n", index);
2849dd8bc72b62 Taniya Das 2018-12-14 355 goto error;
2849dd8bc72b62 Taniya Das 2018-12-14 356 }
2849dd8bc72b62 Taniya Das 2018-12-14 357
55538fbc79e926 Taniya Das 2019-01-31 358 ret = dev_pm_opp_get_opp_count(cpu_dev);
55538fbc79e926 Taniya Das 2019-01-31 359 if (ret <= 0) {
55538fbc79e926 Taniya Das 2019-01-31 360 dev_err(cpu_dev, "Failed to add OPPs\n");
55538fbc79e926 Taniya Das 2019-01-31 361 ret = -ENODEV;
55538fbc79e926 Taniya Das 2019-01-31 362 goto error;
55538fbc79e926 Taniya Das 2019-01-31 363 }
55538fbc79e926 Taniya Das 2019-01-31 364
0e0ffa855d1590 Lukasz Luba 2020-05-27 365 dev_pm_opp_of_register_em(cpu_dev, policy->cpus);
dab535052f67db Matthias Kaehlcke 2019-02-05 366
266991721c15f9 Shawn Guo 2021-01-13 367 if (policy_has_boost_freq(policy)) {
266991721c15f9 Shawn Guo 2021-01-13 368 ret = cpufreq_enable_boost_support();
266991721c15f9 Shawn Guo 2021-01-13 369 if (ret)
266991721c15f9 Shawn Guo 2021-01-13 370 dev_warn(cpu_dev, "failed to enable boost: %d\n", ret);
266991721c15f9 Shawn Guo 2021-01-13 371 }
266991721c15f9 Shawn Guo 2021-01-13 372
2849dd8bc72b62 Taniya Das 2018-12-14 373 return 0;
2849dd8bc72b62 Taniya Das 2018-12-14 374 error:
67fc209b527d02 Shawn Guo 2021-01-19 375 kfree(data);
67fc209b527d02 Shawn Guo 2021-01-19 376 unmap_base:
67fc209b527d02 Shawn Guo 2021-01-19 @377 iounmap(data->base);
Use after free. iounmap(base);
67fc209b527d02 Shawn Guo 2021-01-19 378 release_region:
67fc209b527d02 Shawn Guo 2021-01-19 379 release_mem_region(res->start, resource_size(res));
2849dd8bc72b62 Taniya Das 2018-12-14 380 return ret;
2849dd8bc72b62 Taniya Das 2018-12-14 381 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 33206 bytes --]
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: kbuild-all@lists.01.org
Subject: drivers/cpufreq/qcom-cpufreq-hw.c:377 qcom_cpufreq_hw_cpu_init() error: we previously assumed 'data' could be null (see line 327)
Date: Sat, 27 Feb 2021 12:26:20 +0300 [thread overview]
Message-ID: <20210227092620.GD2087@kadam> (raw)
[-- Attachment #1: Type: text/plain, Size: 9235 bytes --]
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 8b83369ddcb3fb9cab5c1088987ce477565bb630
commit: 67fc209b527d023db4d087c68e44e9790aa089ef cpufreq: qcom-hw: drop devm_xxx() calls from init/exit hooks
config: arm64-randconfig-m031-20210226 (attached as .config)
compiler: aarch64-linux-gcc (GCC) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
smatch warnings:
drivers/cpufreq/qcom-cpufreq-hw.c:377 qcom_cpufreq_hw_cpu_init() error: we previously assumed 'data' could be null (see line 327)
drivers/cpufreq/qcom-cpufreq-hw.c:377 qcom_cpufreq_hw_cpu_init() error: dereferencing freed memory 'data'
vim +/data +377 drivers/cpufreq/qcom-cpufreq-hw.c
2849dd8bc72b62 Taniya Das 2018-12-14 277 static int qcom_cpufreq_hw_cpu_init(struct cpufreq_policy *policy)
2849dd8bc72b62 Taniya Das 2018-12-14 278 {
bd74e286b35413 Manivannan Sadhasivam 2020-09-08 279 struct platform_device *pdev = cpufreq_get_driver_data();
bd74e286b35413 Manivannan Sadhasivam 2020-09-08 280 struct device *dev = &pdev->dev;
2849dd8bc72b62 Taniya Das 2018-12-14 281 struct of_phandle_args args;
2849dd8bc72b62 Taniya Das 2018-12-14 282 struct device_node *cpu_np;
55538fbc79e926 Taniya Das 2019-01-31 283 struct device *cpu_dev;
67fc209b527d02 Shawn Guo 2021-01-19 284 struct resource *res;
2849dd8bc72b62 Taniya Das 2018-12-14 285 void __iomem *base;
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 286 struct qcom_cpufreq_data *data;
2849dd8bc72b62 Taniya Das 2018-12-14 287 int ret, index;
2849dd8bc72b62 Taniya Das 2018-12-14 288
55538fbc79e926 Taniya Das 2019-01-31 289 cpu_dev = get_cpu_device(policy->cpu);
55538fbc79e926 Taniya Das 2019-01-31 290 if (!cpu_dev) {
55538fbc79e926 Taniya Das 2019-01-31 291 pr_err("%s: failed to get cpu%d device\n", __func__,
55538fbc79e926 Taniya Das 2019-01-31 292 policy->cpu);
55538fbc79e926 Taniya Das 2019-01-31 293 return -ENODEV;
55538fbc79e926 Taniya Das 2019-01-31 294 }
55538fbc79e926 Taniya Das 2019-01-31 295
2849dd8bc72b62 Taniya Das 2018-12-14 296 cpu_np = of_cpu_device_node_get(policy->cpu);
2849dd8bc72b62 Taniya Das 2018-12-14 297 if (!cpu_np)
2849dd8bc72b62 Taniya Das 2018-12-14 298 return -EINVAL;
2849dd8bc72b62 Taniya Das 2018-12-14 299
2849dd8bc72b62 Taniya Das 2018-12-14 300 ret = of_parse_phandle_with_args(cpu_np, "qcom,freq-domain",
2849dd8bc72b62 Taniya Das 2018-12-14 301 "#freq-domain-cells", 0, &args);
2849dd8bc72b62 Taniya Das 2018-12-14 302 of_node_put(cpu_np);
2849dd8bc72b62 Taniya Das 2018-12-14 303 if (ret)
2849dd8bc72b62 Taniya Das 2018-12-14 304 return ret;
2849dd8bc72b62 Taniya Das 2018-12-14 305
2849dd8bc72b62 Taniya Das 2018-12-14 306 index = args.args[0];
2849dd8bc72b62 Taniya Das 2018-12-14 307
67fc209b527d02 Shawn Guo 2021-01-19 308 res = platform_get_resource(pdev, IORESOURCE_MEM, index);
67fc209b527d02 Shawn Guo 2021-01-19 309 if (!res) {
67fc209b527d02 Shawn Guo 2021-01-19 310 dev_err(dev, "failed to get mem resource %d\n", index);
67fc209b527d02 Shawn Guo 2021-01-19 311 return -ENODEV;
67fc209b527d02 Shawn Guo 2021-01-19 312 }
67fc209b527d02 Shawn Guo 2021-01-19 313
67fc209b527d02 Shawn Guo 2021-01-19 314 if (!request_mem_region(res->start, resource_size(res), res->name)) {
67fc209b527d02 Shawn Guo 2021-01-19 315 dev_err(dev, "failed to request resource %pR\n", res);
67fc209b527d02 Shawn Guo 2021-01-19 316 return -EBUSY;
67fc209b527d02 Shawn Guo 2021-01-19 317 }
2849dd8bc72b62 Taniya Das 2018-12-14 318
67fc209b527d02 Shawn Guo 2021-01-19 319 base = ioremap(res->start, resource_size(res));
67fc209b527d02 Shawn Guo 2021-01-19 320 if (IS_ERR(base)) {
67fc209b527d02 Shawn Guo 2021-01-19 321 dev_err(dev, "failed to map resource %pR\n", res);
67fc209b527d02 Shawn Guo 2021-01-19 322 ret = PTR_ERR(base);
67fc209b527d02 Shawn Guo 2021-01-19 323 goto release_region;
67fc209b527d02 Shawn Guo 2021-01-19 324 }
67fc209b527d02 Shawn Guo 2021-01-19 325
67fc209b527d02 Shawn Guo 2021-01-19 326 data = kzalloc(sizeof(*data), GFP_KERNEL);
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 @327 if (!data) {
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 328 ret = -ENOMEM;
67fc209b527d02 Shawn Guo 2021-01-19 329 goto unmap_base;
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 330 }
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 331
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 332 data->soc_data = of_device_get_match_data(&pdev->dev);
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 333 data->base = base;
67fc209b527d02 Shawn Guo 2021-01-19 334 data->res = res;
2849dd8bc72b62 Taniya Das 2018-12-14 335
2849dd8bc72b62 Taniya Das 2018-12-14 336 /* HW should be in enabled state to proceed */
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 337 if (!(readl_relaxed(base + data->soc_data->reg_enable) & 0x1)) {
2849dd8bc72b62 Taniya Das 2018-12-14 338 dev_err(dev, "Domain-%d cpufreq hardware not enabled\n", index);
2849dd8bc72b62 Taniya Das 2018-12-14 339 ret = -ENODEV;
2849dd8bc72b62 Taniya Das 2018-12-14 340 goto error;
2849dd8bc72b62 Taniya Das 2018-12-14 341 }
2849dd8bc72b62 Taniya Das 2018-12-14 342
2849dd8bc72b62 Taniya Das 2018-12-14 343 qcom_get_related_cpus(index, policy->cpus);
2849dd8bc72b62 Taniya Das 2018-12-14 344 if (!cpumask_weight(policy->cpus)) {
2849dd8bc72b62 Taniya Das 2018-12-14 345 dev_err(dev, "Domain-%d failed to get related CPUs\n", index);
2849dd8bc72b62 Taniya Das 2018-12-14 346 ret = -ENOENT;
2849dd8bc72b62 Taniya Das 2018-12-14 347 goto error;
2849dd8bc72b62 Taniya Das 2018-12-14 348 }
2849dd8bc72b62 Taniya Das 2018-12-14 349
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 350 policy->driver_data = data;
2849dd8bc72b62 Taniya Das 2018-12-14 351
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 352 ret = qcom_cpufreq_hw_read_lut(cpu_dev, policy);
2849dd8bc72b62 Taniya Das 2018-12-14 353 if (ret) {
2849dd8bc72b62 Taniya Das 2018-12-14 354 dev_err(dev, "Domain-%d failed to read LUT\n", index);
2849dd8bc72b62 Taniya Das 2018-12-14 355 goto error;
2849dd8bc72b62 Taniya Das 2018-12-14 356 }
2849dd8bc72b62 Taniya Das 2018-12-14 357
55538fbc79e926 Taniya Das 2019-01-31 358 ret = dev_pm_opp_get_opp_count(cpu_dev);
55538fbc79e926 Taniya Das 2019-01-31 359 if (ret <= 0) {
55538fbc79e926 Taniya Das 2019-01-31 360 dev_err(cpu_dev, "Failed to add OPPs\n");
55538fbc79e926 Taniya Das 2019-01-31 361 ret = -ENODEV;
55538fbc79e926 Taniya Das 2019-01-31 362 goto error;
55538fbc79e926 Taniya Das 2019-01-31 363 }
55538fbc79e926 Taniya Das 2019-01-31 364
0e0ffa855d1590 Lukasz Luba 2020-05-27 365 dev_pm_opp_of_register_em(cpu_dev, policy->cpus);
dab535052f67db Matthias Kaehlcke 2019-02-05 366
266991721c15f9 Shawn Guo 2021-01-13 367 if (policy_has_boost_freq(policy)) {
266991721c15f9 Shawn Guo 2021-01-13 368 ret = cpufreq_enable_boost_support();
266991721c15f9 Shawn Guo 2021-01-13 369 if (ret)
266991721c15f9 Shawn Guo 2021-01-13 370 dev_warn(cpu_dev, "failed to enable boost: %d\n", ret);
266991721c15f9 Shawn Guo 2021-01-13 371 }
266991721c15f9 Shawn Guo 2021-01-13 372
2849dd8bc72b62 Taniya Das 2018-12-14 373 return 0;
2849dd8bc72b62 Taniya Das 2018-12-14 374 error:
67fc209b527d02 Shawn Guo 2021-01-19 375 kfree(data);
67fc209b527d02 Shawn Guo 2021-01-19 376 unmap_base:
67fc209b527d02 Shawn Guo 2021-01-19 @377 iounmap(data->base);
Use after free. iounmap(base);
67fc209b527d02 Shawn Guo 2021-01-19 378 release_region:
67fc209b527d02 Shawn Guo 2021-01-19 379 release_mem_region(res->start, resource_size(res));
2849dd8bc72b62 Taniya Das 2018-12-14 380 return ret;
2849dd8bc72b62 Taniya Das 2018-12-14 381 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 33206 bytes --]
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: kbuild@lists.01.org, Shawn Guo <shawn.guo@linaro.org>
Cc: lkp@intel.com, kbuild-all@lists.01.org,
linux-kernel@vger.kernel.org,
Viresh Kumar <viresh.kumar@linaro.org>
Subject: drivers/cpufreq/qcom-cpufreq-hw.c:377 qcom_cpufreq_hw_cpu_init() error: we previously assumed 'data' could be null (see line 327)
Date: Sat, 27 Feb 2021 12:26:20 +0300 [thread overview]
Message-ID: <20210227092620.GD2087@kadam> (raw)
[-- Attachment #1: Type: text/plain, Size: 9105 bytes --]
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 8b83369ddcb3fb9cab5c1088987ce477565bb630
commit: 67fc209b527d023db4d087c68e44e9790aa089ef cpufreq: qcom-hw: drop devm_xxx() calls from init/exit hooks
config: arm64-randconfig-m031-20210226 (attached as .config)
compiler: aarch64-linux-gcc (GCC) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
smatch warnings:
drivers/cpufreq/qcom-cpufreq-hw.c:377 qcom_cpufreq_hw_cpu_init() error: we previously assumed 'data' could be null (see line 327)
drivers/cpufreq/qcom-cpufreq-hw.c:377 qcom_cpufreq_hw_cpu_init() error: dereferencing freed memory 'data'
vim +/data +377 drivers/cpufreq/qcom-cpufreq-hw.c
2849dd8bc72b62 Taniya Das 2018-12-14 277 static int qcom_cpufreq_hw_cpu_init(struct cpufreq_policy *policy)
2849dd8bc72b62 Taniya Das 2018-12-14 278 {
bd74e286b35413 Manivannan Sadhasivam 2020-09-08 279 struct platform_device *pdev = cpufreq_get_driver_data();
bd74e286b35413 Manivannan Sadhasivam 2020-09-08 280 struct device *dev = &pdev->dev;
2849dd8bc72b62 Taniya Das 2018-12-14 281 struct of_phandle_args args;
2849dd8bc72b62 Taniya Das 2018-12-14 282 struct device_node *cpu_np;
55538fbc79e926 Taniya Das 2019-01-31 283 struct device *cpu_dev;
67fc209b527d02 Shawn Guo 2021-01-19 284 struct resource *res;
2849dd8bc72b62 Taniya Das 2018-12-14 285 void __iomem *base;
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 286 struct qcom_cpufreq_data *data;
2849dd8bc72b62 Taniya Das 2018-12-14 287 int ret, index;
2849dd8bc72b62 Taniya Das 2018-12-14 288
55538fbc79e926 Taniya Das 2019-01-31 289 cpu_dev = get_cpu_device(policy->cpu);
55538fbc79e926 Taniya Das 2019-01-31 290 if (!cpu_dev) {
55538fbc79e926 Taniya Das 2019-01-31 291 pr_err("%s: failed to get cpu%d device\n", __func__,
55538fbc79e926 Taniya Das 2019-01-31 292 policy->cpu);
55538fbc79e926 Taniya Das 2019-01-31 293 return -ENODEV;
55538fbc79e926 Taniya Das 2019-01-31 294 }
55538fbc79e926 Taniya Das 2019-01-31 295
2849dd8bc72b62 Taniya Das 2018-12-14 296 cpu_np = of_cpu_device_node_get(policy->cpu);
2849dd8bc72b62 Taniya Das 2018-12-14 297 if (!cpu_np)
2849dd8bc72b62 Taniya Das 2018-12-14 298 return -EINVAL;
2849dd8bc72b62 Taniya Das 2018-12-14 299
2849dd8bc72b62 Taniya Das 2018-12-14 300 ret = of_parse_phandle_with_args(cpu_np, "qcom,freq-domain",
2849dd8bc72b62 Taniya Das 2018-12-14 301 "#freq-domain-cells", 0, &args);
2849dd8bc72b62 Taniya Das 2018-12-14 302 of_node_put(cpu_np);
2849dd8bc72b62 Taniya Das 2018-12-14 303 if (ret)
2849dd8bc72b62 Taniya Das 2018-12-14 304 return ret;
2849dd8bc72b62 Taniya Das 2018-12-14 305
2849dd8bc72b62 Taniya Das 2018-12-14 306 index = args.args[0];
2849dd8bc72b62 Taniya Das 2018-12-14 307
67fc209b527d02 Shawn Guo 2021-01-19 308 res = platform_get_resource(pdev, IORESOURCE_MEM, index);
67fc209b527d02 Shawn Guo 2021-01-19 309 if (!res) {
67fc209b527d02 Shawn Guo 2021-01-19 310 dev_err(dev, "failed to get mem resource %d\n", index);
67fc209b527d02 Shawn Guo 2021-01-19 311 return -ENODEV;
67fc209b527d02 Shawn Guo 2021-01-19 312 }
67fc209b527d02 Shawn Guo 2021-01-19 313
67fc209b527d02 Shawn Guo 2021-01-19 314 if (!request_mem_region(res->start, resource_size(res), res->name)) {
67fc209b527d02 Shawn Guo 2021-01-19 315 dev_err(dev, "failed to request resource %pR\n", res);
67fc209b527d02 Shawn Guo 2021-01-19 316 return -EBUSY;
67fc209b527d02 Shawn Guo 2021-01-19 317 }
2849dd8bc72b62 Taniya Das 2018-12-14 318
67fc209b527d02 Shawn Guo 2021-01-19 319 base = ioremap(res->start, resource_size(res));
67fc209b527d02 Shawn Guo 2021-01-19 320 if (IS_ERR(base)) {
67fc209b527d02 Shawn Guo 2021-01-19 321 dev_err(dev, "failed to map resource %pR\n", res);
67fc209b527d02 Shawn Guo 2021-01-19 322 ret = PTR_ERR(base);
67fc209b527d02 Shawn Guo 2021-01-19 323 goto release_region;
67fc209b527d02 Shawn Guo 2021-01-19 324 }
67fc209b527d02 Shawn Guo 2021-01-19 325
67fc209b527d02 Shawn Guo 2021-01-19 326 data = kzalloc(sizeof(*data), GFP_KERNEL);
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 @327 if (!data) {
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 328 ret = -ENOMEM;
67fc209b527d02 Shawn Guo 2021-01-19 329 goto unmap_base;
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 330 }
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 331
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 332 data->soc_data = of_device_get_match_data(&pdev->dev);
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 333 data->base = base;
67fc209b527d02 Shawn Guo 2021-01-19 334 data->res = res;
2849dd8bc72b62 Taniya Das 2018-12-14 335
2849dd8bc72b62 Taniya Das 2018-12-14 336 /* HW should be in enabled state to proceed */
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 337 if (!(readl_relaxed(base + data->soc_data->reg_enable) & 0x1)) {
2849dd8bc72b62 Taniya Das 2018-12-14 338 dev_err(dev, "Domain-%d cpufreq hardware not enabled\n", index);
2849dd8bc72b62 Taniya Das 2018-12-14 339 ret = -ENODEV;
2849dd8bc72b62 Taniya Das 2018-12-14 340 goto error;
2849dd8bc72b62 Taniya Das 2018-12-14 341 }
2849dd8bc72b62 Taniya Das 2018-12-14 342
2849dd8bc72b62 Taniya Das 2018-12-14 343 qcom_get_related_cpus(index, policy->cpus);
2849dd8bc72b62 Taniya Das 2018-12-14 344 if (!cpumask_weight(policy->cpus)) {
2849dd8bc72b62 Taniya Das 2018-12-14 345 dev_err(dev, "Domain-%d failed to get related CPUs\n", index);
2849dd8bc72b62 Taniya Das 2018-12-14 346 ret = -ENOENT;
2849dd8bc72b62 Taniya Das 2018-12-14 347 goto error;
2849dd8bc72b62 Taniya Das 2018-12-14 348 }
2849dd8bc72b62 Taniya Das 2018-12-14 349
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 350 policy->driver_data = data;
2849dd8bc72b62 Taniya Das 2018-12-14 351
dcd1fd724c19fe Manivannan Sadhasivam 2020-09-15 352 ret = qcom_cpufreq_hw_read_lut(cpu_dev, policy);
2849dd8bc72b62 Taniya Das 2018-12-14 353 if (ret) {
2849dd8bc72b62 Taniya Das 2018-12-14 354 dev_err(dev, "Domain-%d failed to read LUT\n", index);
2849dd8bc72b62 Taniya Das 2018-12-14 355 goto error;
2849dd8bc72b62 Taniya Das 2018-12-14 356 }
2849dd8bc72b62 Taniya Das 2018-12-14 357
55538fbc79e926 Taniya Das 2019-01-31 358 ret = dev_pm_opp_get_opp_count(cpu_dev);
55538fbc79e926 Taniya Das 2019-01-31 359 if (ret <= 0) {
55538fbc79e926 Taniya Das 2019-01-31 360 dev_err(cpu_dev, "Failed to add OPPs\n");
55538fbc79e926 Taniya Das 2019-01-31 361 ret = -ENODEV;
55538fbc79e926 Taniya Das 2019-01-31 362 goto error;
55538fbc79e926 Taniya Das 2019-01-31 363 }
55538fbc79e926 Taniya Das 2019-01-31 364
0e0ffa855d1590 Lukasz Luba 2020-05-27 365 dev_pm_opp_of_register_em(cpu_dev, policy->cpus);
dab535052f67db Matthias Kaehlcke 2019-02-05 366
266991721c15f9 Shawn Guo 2021-01-13 367 if (policy_has_boost_freq(policy)) {
266991721c15f9 Shawn Guo 2021-01-13 368 ret = cpufreq_enable_boost_support();
266991721c15f9 Shawn Guo 2021-01-13 369 if (ret)
266991721c15f9 Shawn Guo 2021-01-13 370 dev_warn(cpu_dev, "failed to enable boost: %d\n", ret);
266991721c15f9 Shawn Guo 2021-01-13 371 }
266991721c15f9 Shawn Guo 2021-01-13 372
2849dd8bc72b62 Taniya Das 2018-12-14 373 return 0;
2849dd8bc72b62 Taniya Das 2018-12-14 374 error:
67fc209b527d02 Shawn Guo 2021-01-19 375 kfree(data);
67fc209b527d02 Shawn Guo 2021-01-19 376 unmap_base:
67fc209b527d02 Shawn Guo 2021-01-19 @377 iounmap(data->base);
Use after free. iounmap(base);
67fc209b527d02 Shawn Guo 2021-01-19 378 release_region:
67fc209b527d02 Shawn Guo 2021-01-19 379 release_mem_region(res->start, resource_size(res));
2849dd8bc72b62 Taniya Das 2018-12-14 380 return ret;
2849dd8bc72b62 Taniya Das 2018-12-14 381 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 33206 bytes --]
next reply other threads:[~2021-02-27 9:26 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-27 9:26 Dan Carpenter [this message]
2021-02-27 9:26 ` drivers/cpufreq/qcom-cpufreq-hw.c:377 qcom_cpufreq_hw_cpu_init() error: we previously assumed 'data' could be null (see line 327) Dan Carpenter
2021-02-27 9:26 ` Dan Carpenter
2021-02-28 1:12 ` Shawn Guo
2021-02-28 1:12 ` Shawn Guo
-- strict thread matches above, loose matches on Subject: below --
2021-02-26 22:46 kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210227092620.GD2087@kadam \
--to=dan.carpenter@oracle.com \
--cc=kbuild@lists.01.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.