From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: drivers/net/ethernet/intel/idpf/idpf_idc.c:93 idpf_plug_core_aux_dev() error: dereferencing freed memory 'adev' (line 75)
Date: Thu, 14 May 2026 16:37:46 +0800 [thread overview]
Message-ID: <202605141659.ITAp29HS-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Joshua Hay <joshua.a.hay@intel.com>
CC: Tony Nguyen <anthony.l.nguyen@intel.com>
CC: Madhu Chittim <madhu.chittim@intel.com>
CC: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: e1914add2799225a87502051415fc5c32aeb02ae
commit: f4312e6bfa2a98e94dacc75f96f916b76bdf4259 idpf: implement core RDMA auxiliary dev create, init, and destroy
date: 10 months ago
:::::: branch date: 14 hours ago
:::::: commit date: 10 months ago
config: i386-randconfig-141-20260514 (https://download.01.org/0day-ci/archive/20260514/202605141659.ITAp29HS-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: f4312e6bfa2a ("idpf: implement core RDMA auxiliary dev create, init, and destroy")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202605141659.ITAp29HS-lkp@intel.com/
smatch warnings:
drivers/net/ethernet/intel/idpf/idpf_idc.c:93 idpf_plug_core_aux_dev() error: dereferencing freed memory 'adev' (line 75)
vim +/adev +93 drivers/net/ethernet/intel/idpf/idpf_idc.c
f4312e6bfa2a98 Joshua Hay 2025-07-08 47
f4312e6bfa2a98 Joshua Hay 2025-07-08 48 /**
f4312e6bfa2a98 Joshua Hay 2025-07-08 49 * idpf_plug_core_aux_dev - allocate and register an Auxiliary device
f4312e6bfa2a98 Joshua Hay 2025-07-08 50 * @cdev_info: IDC core device info pointer
f4312e6bfa2a98 Joshua Hay 2025-07-08 51 *
f4312e6bfa2a98 Joshua Hay 2025-07-08 52 * Return: 0 on success or error code on failure.
f4312e6bfa2a98 Joshua Hay 2025-07-08 53 */
f4312e6bfa2a98 Joshua Hay 2025-07-08 54 static int idpf_plug_core_aux_dev(struct iidc_rdma_core_dev_info *cdev_info)
f4312e6bfa2a98 Joshua Hay 2025-07-08 55 {
f4312e6bfa2a98 Joshua Hay 2025-07-08 56 struct iidc_rdma_core_auxiliary_dev *iadev;
f4312e6bfa2a98 Joshua Hay 2025-07-08 57 char name[IDPF_IDC_MAX_ADEV_NAME_LEN];
f4312e6bfa2a98 Joshua Hay 2025-07-08 58 struct auxiliary_device *adev;
f4312e6bfa2a98 Joshua Hay 2025-07-08 59 int ret;
f4312e6bfa2a98 Joshua Hay 2025-07-08 60
f4312e6bfa2a98 Joshua Hay 2025-07-08 61 iadev = kzalloc(sizeof(*iadev), GFP_KERNEL);
f4312e6bfa2a98 Joshua Hay 2025-07-08 62 if (!iadev)
f4312e6bfa2a98 Joshua Hay 2025-07-08 63 return -ENOMEM;
f4312e6bfa2a98 Joshua Hay 2025-07-08 64
f4312e6bfa2a98 Joshua Hay 2025-07-08 65 adev = &iadev->adev;
f4312e6bfa2a98 Joshua Hay 2025-07-08 66 cdev_info->adev = adev;
f4312e6bfa2a98 Joshua Hay 2025-07-08 67 iadev->cdev_info = cdev_info;
f4312e6bfa2a98 Joshua Hay 2025-07-08 68
f4312e6bfa2a98 Joshua Hay 2025-07-08 69 ret = ida_alloc(&idpf_idc_ida, GFP_KERNEL);
f4312e6bfa2a98 Joshua Hay 2025-07-08 70 if (ret < 0) {
f4312e6bfa2a98 Joshua Hay 2025-07-08 71 pr_err("failed to allocate unique device ID for Auxiliary driver\n");
f4312e6bfa2a98 Joshua Hay 2025-07-08 72 goto err_ida_alloc;
f4312e6bfa2a98 Joshua Hay 2025-07-08 73 }
f4312e6bfa2a98 Joshua Hay 2025-07-08 74 adev->id = ret;
f4312e6bfa2a98 Joshua Hay 2025-07-08 @75 adev->dev.release = idpf_core_adev_release;
f4312e6bfa2a98 Joshua Hay 2025-07-08 76 adev->dev.parent = &cdev_info->pdev->dev;
f4312e6bfa2a98 Joshua Hay 2025-07-08 77 sprintf(name, "%04x.rdma.core", cdev_info->pdev->vendor);
f4312e6bfa2a98 Joshua Hay 2025-07-08 78 adev->name = name;
f4312e6bfa2a98 Joshua Hay 2025-07-08 79
f4312e6bfa2a98 Joshua Hay 2025-07-08 80 ret = auxiliary_device_init(adev);
f4312e6bfa2a98 Joshua Hay 2025-07-08 81 if (ret)
f4312e6bfa2a98 Joshua Hay 2025-07-08 82 goto err_aux_dev_init;
f4312e6bfa2a98 Joshua Hay 2025-07-08 83
f4312e6bfa2a98 Joshua Hay 2025-07-08 84 ret = auxiliary_device_add(adev);
f4312e6bfa2a98 Joshua Hay 2025-07-08 85 if (ret)
f4312e6bfa2a98 Joshua Hay 2025-07-08 86 goto err_aux_dev_add;
f4312e6bfa2a98 Joshua Hay 2025-07-08 87
f4312e6bfa2a98 Joshua Hay 2025-07-08 88 return 0;
f4312e6bfa2a98 Joshua Hay 2025-07-08 89
f4312e6bfa2a98 Joshua Hay 2025-07-08 90 err_aux_dev_add:
f4312e6bfa2a98 Joshua Hay 2025-07-08 91 auxiliary_device_uninit(adev);
f4312e6bfa2a98 Joshua Hay 2025-07-08 92 err_aux_dev_init:
f4312e6bfa2a98 Joshua Hay 2025-07-08 @93 ida_free(&idpf_idc_ida, adev->id);
f4312e6bfa2a98 Joshua Hay 2025-07-08 94 err_ida_alloc:
f4312e6bfa2a98 Joshua Hay 2025-07-08 95 cdev_info->adev = NULL;
f4312e6bfa2a98 Joshua Hay 2025-07-08 96 kfree(iadev);
f4312e6bfa2a98 Joshua Hay 2025-07-08 97
f4312e6bfa2a98 Joshua Hay 2025-07-08 98 return ret;
f4312e6bfa2a98 Joshua Hay 2025-07-08 99 }
f4312e6bfa2a98 Joshua Hay 2025-07-08 100
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <error27@gmail.com>
To: oe-kbuild@lists.linux.dev, Joshua Hay <joshua.a.hay@intel.com>
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev,
linux-kernel@vger.kernel.org,
Tony Nguyen <anthony.l.nguyen@intel.com>,
Madhu Chittim <madhu.chittim@intel.com>,
Tatyana Nikolova <tatyana.e.nikolova@intel.com>
Subject: drivers/net/ethernet/intel/idpf/idpf_idc.c:93 idpf_plug_core_aux_dev() error: dereferencing freed memory 'adev' (line 75)
Date: Thu, 14 May 2026 11:47:25 +0300 [thread overview]
Message-ID: <202605141659.ITAp29HS-lkp@intel.com> (raw)
Message-ID: <20260514084725.-Wc0WL8jyPXKCdK-LN3BOYTCyRB7ih0wg8E3jvyuJlA@z> (raw)
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: e1914add2799225a87502051415fc5c32aeb02ae
commit: f4312e6bfa2a98e94dacc75f96f916b76bdf4259 idpf: implement core RDMA auxiliary dev create, init, and destroy
config: i386-randconfig-141-20260514 (https://download.01.org/0day-ci/archive/20260514/202605141659.ITAp29HS-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: f4312e6bfa2a ("idpf: implement core RDMA auxiliary dev create, init, and destroy")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202605141659.ITAp29HS-lkp@intel.com/
smatch warnings:
drivers/net/ethernet/intel/idpf/idpf_idc.c:93 idpf_plug_core_aux_dev() error: dereferencing freed memory 'adev' (line 75)
vim +/adev +93 drivers/net/ethernet/intel/idpf/idpf_idc.c
f4312e6bfa2a98 Joshua Hay 2025-07-08 54 static int idpf_plug_core_aux_dev(struct iidc_rdma_core_dev_info *cdev_info)
f4312e6bfa2a98 Joshua Hay 2025-07-08 55 {
f4312e6bfa2a98 Joshua Hay 2025-07-08 56 struct iidc_rdma_core_auxiliary_dev *iadev;
f4312e6bfa2a98 Joshua Hay 2025-07-08 57 char name[IDPF_IDC_MAX_ADEV_NAME_LEN];
f4312e6bfa2a98 Joshua Hay 2025-07-08 58 struct auxiliary_device *adev;
f4312e6bfa2a98 Joshua Hay 2025-07-08 59 int ret;
f4312e6bfa2a98 Joshua Hay 2025-07-08 60
f4312e6bfa2a98 Joshua Hay 2025-07-08 61 iadev = kzalloc(sizeof(*iadev), GFP_KERNEL);
f4312e6bfa2a98 Joshua Hay 2025-07-08 62 if (!iadev)
f4312e6bfa2a98 Joshua Hay 2025-07-08 63 return -ENOMEM;
f4312e6bfa2a98 Joshua Hay 2025-07-08 64
f4312e6bfa2a98 Joshua Hay 2025-07-08 65 adev = &iadev->adev;
f4312e6bfa2a98 Joshua Hay 2025-07-08 66 cdev_info->adev = adev;
f4312e6bfa2a98 Joshua Hay 2025-07-08 67 iadev->cdev_info = cdev_info;
f4312e6bfa2a98 Joshua Hay 2025-07-08 68
f4312e6bfa2a98 Joshua Hay 2025-07-08 69 ret = ida_alloc(&idpf_idc_ida, GFP_KERNEL);
f4312e6bfa2a98 Joshua Hay 2025-07-08 70 if (ret < 0) {
f4312e6bfa2a98 Joshua Hay 2025-07-08 71 pr_err("failed to allocate unique device ID for Auxiliary driver\n");
f4312e6bfa2a98 Joshua Hay 2025-07-08 72 goto err_ida_alloc;
f4312e6bfa2a98 Joshua Hay 2025-07-08 73 }
f4312e6bfa2a98 Joshua Hay 2025-07-08 74 adev->id = ret;
f4312e6bfa2a98 Joshua Hay 2025-07-08 @75 adev->dev.release = idpf_core_adev_release;
f4312e6bfa2a98 Joshua Hay 2025-07-08 76 adev->dev.parent = &cdev_info->pdev->dev;
f4312e6bfa2a98 Joshua Hay 2025-07-08 77 sprintf(name, "%04x.rdma.core", cdev_info->pdev->vendor);
f4312e6bfa2a98 Joshua Hay 2025-07-08 78 adev->name = name;
f4312e6bfa2a98 Joshua Hay 2025-07-08 79
f4312e6bfa2a98 Joshua Hay 2025-07-08 80 ret = auxiliary_device_init(adev);
f4312e6bfa2a98 Joshua Hay 2025-07-08 81 if (ret)
f4312e6bfa2a98 Joshua Hay 2025-07-08 82 goto err_aux_dev_init;
f4312e6bfa2a98 Joshua Hay 2025-07-08 83
f4312e6bfa2a98 Joshua Hay 2025-07-08 84 ret = auxiliary_device_add(adev);
f4312e6bfa2a98 Joshua Hay 2025-07-08 85 if (ret)
f4312e6bfa2a98 Joshua Hay 2025-07-08 86 goto err_aux_dev_add;
f4312e6bfa2a98 Joshua Hay 2025-07-08 87
f4312e6bfa2a98 Joshua Hay 2025-07-08 88 return 0;
f4312e6bfa2a98 Joshua Hay 2025-07-08 89
f4312e6bfa2a98 Joshua Hay 2025-07-08 90 err_aux_dev_add:
f4312e6bfa2a98 Joshua Hay 2025-07-08 91 auxiliary_device_uninit(adev);
f4312e6bfa2a98 Joshua Hay 2025-07-08 92 err_aux_dev_init:
f4312e6bfa2a98 Joshua Hay 2025-07-08 @93 ida_free(&idpf_idc_ida, adev->id);
^^^^^^^^^
I could have sworn I saw patches to fix this use after free months ago
but it's still a bug in net-next. idpf_core_adev_release() frees iadev
and adev is a to inside iadev.
f4312e6bfa2a98 Joshua Hay 2025-07-08 94 err_ida_alloc:
f4312e6bfa2a98 Joshua Hay 2025-07-08 95 cdev_info->adev = NULL;
f4312e6bfa2a98 Joshua Hay 2025-07-08 96 kfree(iadev);
f4312e6bfa2a98 Joshua Hay 2025-07-08 97
f4312e6bfa2a98 Joshua Hay 2025-07-08 98 return ret;
f4312e6bfa2a98 Joshua Hay 2025-07-08 99 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-05-14 8:38 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-14 8:37 kernel test robot [this message]
2026-05-14 8:47 ` drivers/net/ethernet/intel/idpf/idpf_idc.c:93 idpf_plug_core_aux_dev() error: dereferencing freed memory 'adev' (line 75) Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202605141659.ITAp29HS-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.