[linux-next:master 892/4731] drivers/spi/spi-aspeed-smc.c:399:3-10: WARNING: invalid free of devm_ allocated data

[linux-next:master 892/4731] drivers/spi/spi-aspeed-smc.c:399:3-10: WARNING: invalid free of devm_ allocated data

[kernel test robot]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head:   f9ba12abc5282bf992f9a9ae87ad814fd03a0270
commit: 64d87ccfae3326a9561fe41dc6073064a083e0df [892/4731] spi: aspeed: Only map necessary address window region
config: sparc64-randconfig-r054-20251029 (https://download.01.org/0day-ci/archive/20251029/202510292356.JnTUBxCl-lkp@intel.com/config)
compiler: sparc64-linux-gcc (GCC) 8.5.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202510292356.JnTUBxCl-lkp@intel.com/

cocci warnings: (new ones prefixed by >>)
>> drivers/spi/spi-aspeed-smc.c:399:3-10: WARNING: invalid free of devm_ allocated data

vim +399 drivers/spi/spi-aspeed-smc.c

   383	
   384	static int aspeed_spi_set_window(struct aspeed_spi *aspi)
   385	{
   386		struct device *dev = aspi->dev;
   387		off_t offset = 0;
   388		phys_addr_t start;
   389		phys_addr_t end;
   390		void __iomem *seg_reg_base = aspi->regs + CE0_SEGMENT_ADDR_REG;
   391		void __iomem *seg_reg;
   392		u32 seg_val_backup;
   393		u32 seg_val;
   394		u32 cs;
   395		size_t window_size;
   396	
   397		for (cs = 0; cs < aspi->data->max_cs; cs++) {
   398			if (aspi->chips[cs].ahb_base) {
 > 399				iounmap(aspi->chips[cs].ahb_base);
   400				aspi->chips[cs].ahb_base = NULL;
   401			}
   402		}
   403	
   404		for (cs = 0; cs < aspi->data->max_cs; cs++) {
   405			seg_reg = seg_reg_base + cs * 4;
   406			seg_val_backup = readl(seg_reg);
   407	
   408			start = aspi->ahb_base_phy + offset;
   409			window_size = aspi->chips[cs].ahb_window_size;
   410			end = start + window_size;
   411	
   412			seg_val = aspi->data->segment_reg(aspi, start, end);
   413			writel(seg_val, seg_reg);
   414	
   415			/*
   416			 * Restore initial value if something goes wrong or the segment
   417			 * register is written protected.
   418			 */
   419			if (seg_val != readl(seg_reg)) {
   420				dev_warn(dev, "CE%d expected window [ 0x%.9llx - 0x%.9llx ] %zdMB\n",
   421					 cs, (u64)start, (u64)end - 1, window_size >> 20);
   422				writel(seg_val_backup, seg_reg);
   423				window_size = aspi->data->segment_end(aspi, seg_val_backup) -
   424					      aspi->data->segment_start(aspi, seg_val_backup);
   425				aspi->chips[cs].ahb_window_size = window_size;
   426				end = start + window_size;
   427			}
   428	
   429			if (window_size != 0)
   430				dev_dbg(dev, "CE%d window [ 0x%.9llx - 0x%.9llx ] %zdMB\n",
   431					cs, (u64)start, (u64)end - 1,  window_size >> 20);
   432			else
   433				dev_dbg(dev, "CE%d window closed\n", cs);
   434	
   435			offset += window_size;
   436			if (offset > aspi->ahb_window_size) {
   437				dev_err(dev, "CE%d offset value 0x%llx is too large.\n",
   438					cs, (u64)offset);
   439				return -ENOSPC;
   440			}
   441	
   442			/*
   443			 * No need to map the address deocding range when
   444			 * - window size is 0.
   445			 * - the CS is unused.
   446			 */
   447			if (window_size == 0 || cs >= aspi->num_cs)
   448				continue;
   449	
   450			aspi->chips[cs].ahb_base =
   451				devm_ioremap(aspi->dev, start, window_size);
   452			if (!aspi->chips[cs].ahb_base) {
   453				dev_err(aspi->dev,
   454					"Fail to remap window [0x%.9llx - 0x%.9llx]\n",
   455					(u64)start, (u64)end - 1);
   456				return -ENOMEM;
   457			}
   458		}
   459	
   460		return 0;
   461	}
   462	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki