Re: [bug report] rpmsg: char: Implement eptdev based on anonymous inode

[Dawei Li <dawei.li@linux.dev>]

Hi Dan,

Thanks for the report.

On Wed, Oct 22, 2025 at 02:05:36PM +0300, Dan Carpenter wrote:
> Hello Dawei Li,
> 
> Commit 2410558f5f11 ("rpmsg: char: Implement eptdev based on
> anonymous inode") from Oct 15, 2025 (linux-next), leads to the
> following Smatch static checker warning:
> 
> 	drivers/rpmsg/rpmsg_char.c:548 rpmsg_anonymous_eptdev_create()
> 	error: dereferencing freed memory 'eptdev' (line 546)
> 
> drivers/rpmsg/rpmsg_char.c
>     538         /* Anonymous inode only supports these file flags */
>     539         if (flags & ~(O_ACCMODE | O_NONBLOCK | O_CLOEXEC))
>     540                 return -EINVAL;
>     541 
>     542         eptdev = rpmsg_eptdev_alloc(rpdev, parent, false);
>     543         if (IS_ERR(eptdev))
>     544                 return PTR_ERR(eptdev);
>     545 
>     546         ret =  rpmsg_eptdev_add(eptdev, chinfo, false);
>     547         if (ret) {
> --> 548                 dev_err(&eptdev->dev, "failed to add %s\n", eptdev->chinfo.name);
>                                  ^^^^^^                             ^^^^^^
> The rpmsg_eptdev_add() function frees "eptdev" on error.
> 
>     549                 return ret;
>     550         }
>     551 
>     552         fd = anon_inode_getfd("rpmsg-eptdev", &rpmsg_anonymous_eptdev_fops, eptdev, flags);
>     553         if (fd < 0) {
>     554                 put_device(&eptdev->dev);
>     555                 return fd;
>     556         }
>     557 
>     558         mutex_lock(&eptdev->ept_lock);
>     559         ret = __rpmsg_eptdev_open(eptdev);
> 
> Should we free eptdev if __rpmsg_eptdev_open() fails?
> 
>     560         mutex_unlock(&eptdev->ept_lock);
>     561 
>     562         if (!ret)
>     563                 *pfd = fd;
>     564 
>     565         return ret;
>     566 }
> 
> regards,
> dan carpenter

Diff below should do the trick.

diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c
index 34b35ea74aab..c322df56394f 100644
--- a/drivers/rpmsg/rpmsg_char.c
+++ b/drivers/rpmsg/rpmsg_char.c
@@ -494,6 +494,7 @@ static int rpmsg_eptdev_add(struct rpmsg_eptdev *eptdev,
        if (cdev)
                ida_free(&rpmsg_minor_ida, MINOR(dev->devt));
 free_eptdev:
+       dev_err(&eptdev->dev, "failed to add %s\n", eptdev->chinfo.name);
        put_device(dev);
        kfree(eptdev);

@@ -545,7 +546,6 @@ int rpmsg_anonymous_eptdev_create(struct rpmsg_device *rpdev, struct device *par

        ret =  rpmsg_eptdev_add(eptdev, chinfo, false);
        if (ret) {
-               dev_err(&eptdev->dev, "failed to add %s\n", eptdev->chinfo.name);
                return ret;
        }

@@ -561,6 +561,8 @@ int rpmsg_anonymous_eptdev_create(struct rpmsg_device *rpdev, struct device *par

        if (!ret)
                *pfd = fd;
+       else
+               put_device(&eptdev->dev);

        return ret;
 }

Mathieu, Bjorn,

What do you expect me to do about it?
1. Send an independent fix patch.
2. Squash the fix patch into previous ones and resend series again.
3. Wait for other (if any) bug reports and fix them in a whole.

I am fine with all of them.

Thanks,

	Dawei