diff for duplicates of <202603210811.1eXTfndx-lkp@intel.com> diff --git a/a/1.txt b/N1/1.txt index bc72bdc..af7012a 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -1,14 +1,6 @@ -BCC: lkp@intel.com -CC: oe-kbuild-all@lists.linux.dev -CC: linux-kernel@vger.kernel.org -TO: Yaxing Guo <guoyaxing@bosc.ac.cn> - tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: 42bddab0563fe67882b2722620a66dd98c8dbf33 commit: 3397c3cd859a2c51962ad032dcf97961d42f9db2 uio: Add SVA support for PCI devices via uio_pci_generic_sva.c -date: 4 months ago -:::::: branch date: 5 hours ago -:::::: commit date: 4 months ago config: x86_64-randconfig-161-20260321 (https://download.01.org/0day-ci/archive/20260321/202603210811.1eXTfndx-lkp@intel.com/config) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) smatch: v0.5.0-9004-gb810ac53 @@ -16,19 +8,14 @@ smatch: v0.5.0-9004-gb810ac53 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> -| Reported-by: Dan Carpenter <error27@gmail.com> +| Reported-by: Dan Carpenter <dan.carpenter@linaro.org> | Closes: https://lore.kernel.org/r/202603210811.1eXTfndx-lkp@intel.com/ New smatch warnings: drivers/uio/uio_pci_generic_sva.c:140 probe() warn: passing devm_ allocated variable to kfree. 'udev' -Old smatch warnings: -drivers/uio/uio_pci_generic_sva.c:32 uio_pci_sva_open() error: we previously assumed 'udev' could be null (see line 32) -drivers/uio/uio_pci_generic_sva.c:54 uio_pci_sva_release() error: we previously assumed 'udev' could be null (see line 54) - vim +/udev +140 drivers/uio/uio_pci_generic_sva.c -3397c3cd859a2c Yaxing Guo 2025-09-26 61 3397c3cd859a2c Yaxing Guo 2025-09-26 62 static int probe(struct pci_dev *pdev, const struct pci_device_id *id) 3397c3cd859a2c Yaxing Guo 2025-09-26 63 { 3397c3cd859a2c Yaxing Guo 2025-09-26 64 struct uio_pci_sva_dev *udev; @@ -60,42 +47,17 @@ vim +/udev +140 drivers/uio/uio_pci_generic_sva.c 3397c3cd859a2c Yaxing Guo 2025-09-26 90 3397c3cd859a2c Yaxing Guo 2025-09-26 91 udev = devm_kzalloc(&pdev->dev, sizeof(struct uio_pci_sva_dev), 3397c3cd859a2c Yaxing Guo 2025-09-26 92 GFP_KERNEL); + +udev is devm_ memory. + 3397c3cd859a2c Yaxing Guo 2025-09-26 93 if (!udev) { 3397c3cd859a2c Yaxing Guo 2025-09-26 94 ret = -ENOMEM; 3397c3cd859a2c Yaxing Guo 2025-09-26 95 goto out_disable; 3397c3cd859a2c Yaxing Guo 2025-09-26 96 } 3397c3cd859a2c Yaxing Guo 2025-09-26 97 -3397c3cd859a2c Yaxing Guo 2025-09-26 98 udev->pdev = pdev; -3397c3cd859a2c Yaxing Guo 2025-09-26 99 udev->info.name = "uio_pci_sva"; -3397c3cd859a2c Yaxing Guo 2025-09-26 100 udev->info.version = "0.0.1"; -3397c3cd859a2c Yaxing Guo 2025-09-26 101 udev->info.open = uio_pci_sva_open; -3397c3cd859a2c Yaxing Guo 2025-09-26 102 udev->info.release = uio_pci_sva_release; -3397c3cd859a2c Yaxing Guo 2025-09-26 103 udev->info.irq = irq; -3397c3cd859a2c Yaxing Guo 2025-09-26 104 udev->info.handler = irq_handler; -3397c3cd859a2c Yaxing Guo 2025-09-26 105 udev->info.priv = udev; -3397c3cd859a2c Yaxing Guo 2025-09-26 106 -3397c3cd859a2c Yaxing Guo 2025-09-26 107 for (i = 0; i < MAX_UIO_MAPS; i++) { -3397c3cd859a2c Yaxing Guo 2025-09-26 108 struct resource *r = &pdev->resource[i]; -3397c3cd859a2c Yaxing Guo 2025-09-26 109 struct uio_mem *uiomem = &udev->info.mem[i]; -3397c3cd859a2c Yaxing Guo 2025-09-26 110 -3397c3cd859a2c Yaxing Guo 2025-09-26 111 if (r->flags != (IORESOURCE_SIZEALIGN | IORESOURCE_MEM)) -3397c3cd859a2c Yaxing Guo 2025-09-26 112 continue; -3397c3cd859a2c Yaxing Guo 2025-09-26 113 -3397c3cd859a2c Yaxing Guo 2025-09-26 114 if (uiomem >= &udev->info.mem[MAX_UIO_MAPS]) { -3397c3cd859a2c Yaxing Guo 2025-09-26 115 dev_warn(&pdev->dev, "Do not support more than %d iomem\n", -3397c3cd859a2c Yaxing Guo 2025-09-26 116 MAX_UIO_MAPS); -3397c3cd859a2c Yaxing Guo 2025-09-26 117 break; -3397c3cd859a2c Yaxing Guo 2025-09-26 118 } -3397c3cd859a2c Yaxing Guo 2025-09-26 119 -3397c3cd859a2c Yaxing Guo 2025-09-26 120 uiomem->memtype = UIO_MEM_PHYS; -3397c3cd859a2c Yaxing Guo 2025-09-26 121 uiomem->addr = r->start & PAGE_MASK; -3397c3cd859a2c Yaxing Guo 2025-09-26 122 uiomem->offs = r->start & ~PAGE_MASK; -3397c3cd859a2c Yaxing Guo 2025-09-26 123 uiomem->size = -3397c3cd859a2c Yaxing Guo 2025-09-26 124 (uiomem->offs + resource_size(r) + PAGE_SIZE - 1) & -3397c3cd859a2c Yaxing Guo 2025-09-26 125 PAGE_MASK; -3397c3cd859a2c Yaxing Guo 2025-09-26 126 uiomem->name = r->name; -3397c3cd859a2c Yaxing Guo 2025-09-26 127 } -3397c3cd859a2c Yaxing Guo 2025-09-26 128 + +[ snip ] + 3397c3cd859a2c Yaxing Guo 2025-09-26 129 ret = devm_uio_register_device(&pdev->dev, &udev->info); 3397c3cd859a2c Yaxing Guo 2025-09-26 130 if (ret) { 3397c3cd859a2c Yaxing Guo 2025-09-26 131 dev_err(&pdev->dev, "Failed to register uio device\n"); @@ -108,12 +70,14 @@ vim +/udev +140 drivers/uio/uio_pci_generic_sva.c 3397c3cd859a2c Yaxing Guo 2025-09-26 138 3397c3cd859a2c Yaxing Guo 2025-09-26 139 out_free: 3397c3cd859a2c Yaxing Guo 2025-09-26 @140 kfree(udev); + +So this is a double free. + 3397c3cd859a2c Yaxing Guo 2025-09-26 141 out_disable: 3397c3cd859a2c Yaxing Guo 2025-09-26 142 pci_disable_device(pdev); 3397c3cd859a2c Yaxing Guo 2025-09-26 143 3397c3cd859a2c Yaxing Guo 2025-09-26 144 return ret; 3397c3cd859a2c Yaxing Guo 2025-09-26 145 } -3397c3cd859a2c Yaxing Guo 2025-09-26 146 -- 0-DAY CI Kernel Test Service diff --git a/a/content_digest b/N1/content_digest index fb74c23..86f84b7 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -1,22 +1,16 @@ - "From\0kernel test robot <lkp@intel.com>\0" + "From\0Dan Carpenter <dan.carpenter@linaro.org>\0" "Subject\0drivers/uio/uio_pci_generic_sva.c:140 probe() warn: passing devm_ allocated variable to kfree. 'udev'\0" - "Date\0Sat, 21 Mar 2026 08:42:17 +0800\0" - "To\0oe-kbuild@lists.linux.dev\0" + "Date\0Sat, 21 Mar 2026 11:24:08 +0300\0" + "To\0oe-kbuild@lists.linux.dev" + " Yaxing Guo <guoyaxing@bosc.ac.cn>\0" "Cc\0lkp@intel.com" - " Dan Carpenter <error27@gmail.com>\0" + oe-kbuild-all@lists.linux.dev + " linux-kernel@vger.kernel.org\0" "\00:1\0" "b\0" - "BCC: lkp@intel.com\n" - "CC: oe-kbuild-all@lists.linux.dev\n" - "CC: linux-kernel@vger.kernel.org\n" - "TO: Yaxing Guo <guoyaxing@bosc.ac.cn>\n" - "\n" "tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master\n" "head: 42bddab0563fe67882b2722620a66dd98c8dbf33\n" "commit: 3397c3cd859a2c51962ad032dcf97961d42f9db2 uio: Add SVA support for PCI devices via uio_pci_generic_sva.c\n" - "date: 4 months ago\n" - ":::::: branch date: 5 hours ago\n" - ":::::: commit date: 4 months ago\n" "config: x86_64-randconfig-161-20260321 (https://download.01.org/0day-ci/archive/20260321/202603210811.1eXTfndx-lkp@intel.com/config)\n" "compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)\n" "smatch: v0.5.0-9004-gb810ac53\n" @@ -24,19 +18,14 @@ "If you fix the issue in a separate patch/commit (i.e. not just a new version of\n" "the same patch/commit), kindly add following tags\n" "| Reported-by: kernel test robot <lkp@intel.com>\n" - "| Reported-by: Dan Carpenter <error27@gmail.com>\n" + "| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>\n" "| Closes: https://lore.kernel.org/r/202603210811.1eXTfndx-lkp@intel.com/\n" "\n" "New smatch warnings:\n" "drivers/uio/uio_pci_generic_sva.c:140 probe() warn: passing devm_ allocated variable to kfree. 'udev'\n" "\n" - "Old smatch warnings:\n" - "drivers/uio/uio_pci_generic_sva.c:32 uio_pci_sva_open() error: we previously assumed 'udev' could be null (see line 32)\n" - "drivers/uio/uio_pci_generic_sva.c:54 uio_pci_sva_release() error: we previously assumed 'udev' could be null (see line 54)\n" - "\n" "vim +/udev +140 drivers/uio/uio_pci_generic_sva.c\n" "\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 61 \n" "3397c3cd859a2c Yaxing Guo 2025-09-26 62 static int probe(struct pci_dev *pdev, const struct pci_device_id *id)\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 63 {\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 64 \tstruct uio_pci_sva_dev *udev;\n" @@ -68,42 +57,17 @@ "3397c3cd859a2c Yaxing Guo 2025-09-26 90 \n" "3397c3cd859a2c Yaxing Guo 2025-09-26 91 \tudev = devm_kzalloc(&pdev->dev, sizeof(struct uio_pci_sva_dev),\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 92 \t\t\t GFP_KERNEL);\n" + "\n" + "udev is devm_ memory.\n" + "\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 93 \tif (!udev) {\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 94 \t\tret = -ENOMEM;\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 95 \t\tgoto out_disable;\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 96 \t}\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 97 \n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 98 \tudev->pdev = pdev;\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 99 \tudev->info.name = \"uio_pci_sva\";\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 100 \tudev->info.version = \"0.0.1\";\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 101 \tudev->info.open = uio_pci_sva_open;\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 102 \tudev->info.release = uio_pci_sva_release;\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 103 \tudev->info.irq = irq;\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 104 \tudev->info.handler = irq_handler;\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 105 \tudev->info.priv = udev;\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 106 \n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 107 \tfor (i = 0; i < MAX_UIO_MAPS; i++) {\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 108 \t\tstruct resource *r = &pdev->resource[i];\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 109 \t\tstruct uio_mem *uiomem = &udev->info.mem[i];\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 110 \n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 111 \t\tif (r->flags != (IORESOURCE_SIZEALIGN | IORESOURCE_MEM))\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 112 \t\t\tcontinue;\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 113 \n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 114 \t\tif (uiomem >= &udev->info.mem[MAX_UIO_MAPS]) {\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 115 \t\t\tdev_warn(&pdev->dev, \"Do not support more than %d iomem\\n\",\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 116 \t\t\t\t MAX_UIO_MAPS);\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 117 \t\t\tbreak;\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 118 \t\t}\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 119 \n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 120 \t\tuiomem->memtype = UIO_MEM_PHYS;\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 121 \t\tuiomem->addr = r->start & PAGE_MASK;\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 122 \t\tuiomem->offs = r->start & ~PAGE_MASK;\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 123 \t\tuiomem->size =\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 124 \t\t\t(uiomem->offs + resource_size(r) + PAGE_SIZE - 1) &\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 125 \t\t\tPAGE_MASK;\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 126 \t\tuiomem->name = r->name;\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 127 \t}\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 128 \n" + "\n" + "[ snip ]\n" + "\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 129 \tret = devm_uio_register_device(&pdev->dev, &udev->info);\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 130 \tif (ret) {\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 131 \t\tdev_err(&pdev->dev, \"Failed to register uio device\\n\");\n" @@ -116,15 +80,17 @@ "3397c3cd859a2c Yaxing Guo 2025-09-26 138 \n" "3397c3cd859a2c Yaxing Guo 2025-09-26 139 out_free:\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 @140 \tkfree(udev);\n" + "\n" + "So this is a double free.\n" + "\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 141 out_disable:\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 142 \tpci_disable_device(pdev);\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 143 \n" "3397c3cd859a2c Yaxing Guo 2025-09-26 144 \treturn ret;\n" "3397c3cd859a2c Yaxing Guo 2025-09-26 145 }\n" - "3397c3cd859a2c Yaxing Guo 2025-09-26 146 \n" "\n" "-- \n" "0-DAY CI Kernel Test Service\n" https://github.com/intel/lkp-tests/wiki -0b81076b11ab9b4ccf404d85b2de58a594a30d7a8ddd4d70f78e0a47346034ac +1112eb19684cc027d3f05b6111478de6a1546c544581e0c819d116952882ba7f
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.