From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: drivers/net/ethernet/intel/idpf/idpf_idc.c:95 idpf_plug_vport_aux_dev() error: dereferencing freed memory 'adev' (line 77)
Date: Thu, 14 May 2026 21:02:08 +0800 [thread overview]
Message-ID: <202605142014.gNPFJ2JV-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Joshua Hay <joshua.a.hay@intel.com>
CC: Tony Nguyen <anthony.l.nguyen@intel.com>
CC: Madhu Chittim <madhu.chittim@intel.com>
CC: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: e1914add2799225a87502051415fc5c32aeb02ae
commit: be91128c579c86d295da4325f6ac4710e4e6d2b4 idpf: implement RDMA vport auxiliary dev create, init, and destroy
date: 10 months ago
:::::: branch date: 18 hours ago
:::::: commit date: 10 months ago
config: i386-randconfig-141-20260514 (https://download.01.org/0day-ci/archive/20260514/202605142014.gNPFJ2JV-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: be91128c579c ("idpf: implement RDMA vport auxiliary dev create, init, and destroy")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202605142014.gNPFJ2JV-lkp@intel.com/
New smatch warnings:
drivers/net/ethernet/intel/idpf/idpf_idc.c:95 idpf_plug_vport_aux_dev() error: dereferencing freed memory 'adev' (line 77)
Old smatch warnings:
drivers/net/ethernet/intel/idpf/idpf_idc.c:202 idpf_plug_core_aux_dev() error: dereferencing freed memory 'adev' (line 184)
vim +/adev +95 drivers/net/ethernet/intel/idpf/idpf_idc.c
be91128c579c86d Joshua Hay 2025-07-08 47
be91128c579c86d Joshua Hay 2025-07-08 48 /**
be91128c579c86d Joshua Hay 2025-07-08 49 * idpf_plug_vport_aux_dev - allocate and register a vport Auxiliary device
be91128c579c86d Joshua Hay 2025-07-08 50 * @cdev_info: IDC core device info pointer
be91128c579c86d Joshua Hay 2025-07-08 51 * @vdev_info: IDC vport device info pointer
be91128c579c86d Joshua Hay 2025-07-08 52 *
be91128c579c86d Joshua Hay 2025-07-08 53 * Return: 0 on success or error code on failure.
be91128c579c86d Joshua Hay 2025-07-08 54 */
be91128c579c86d Joshua Hay 2025-07-08 55 static int idpf_plug_vport_aux_dev(struct iidc_rdma_core_dev_info *cdev_info,
be91128c579c86d Joshua Hay 2025-07-08 56 struct iidc_rdma_vport_dev_info *vdev_info)
be91128c579c86d Joshua Hay 2025-07-08 57 {
be91128c579c86d Joshua Hay 2025-07-08 58 struct iidc_rdma_vport_auxiliary_dev *iadev;
be91128c579c86d Joshua Hay 2025-07-08 59 char name[IDPF_IDC_MAX_ADEV_NAME_LEN];
be91128c579c86d Joshua Hay 2025-07-08 60 struct auxiliary_device *adev;
be91128c579c86d Joshua Hay 2025-07-08 61 int ret;
be91128c579c86d Joshua Hay 2025-07-08 62
be91128c579c86d Joshua Hay 2025-07-08 63 iadev = kzalloc(sizeof(*iadev), GFP_KERNEL);
be91128c579c86d Joshua Hay 2025-07-08 64 if (!iadev)
be91128c579c86d Joshua Hay 2025-07-08 65 return -ENOMEM;
be91128c579c86d Joshua Hay 2025-07-08 66
be91128c579c86d Joshua Hay 2025-07-08 67 adev = &iadev->adev;
be91128c579c86d Joshua Hay 2025-07-08 68 vdev_info->adev = &iadev->adev;
be91128c579c86d Joshua Hay 2025-07-08 69 iadev->vdev_info = vdev_info;
be91128c579c86d Joshua Hay 2025-07-08 70
be91128c579c86d Joshua Hay 2025-07-08 71 ret = ida_alloc(&idpf_idc_ida, GFP_KERNEL);
be91128c579c86d Joshua Hay 2025-07-08 72 if (ret < 0) {
be91128c579c86d Joshua Hay 2025-07-08 73 pr_err("failed to allocate unique device ID for Auxiliary driver\n");
be91128c579c86d Joshua Hay 2025-07-08 74 goto err_ida_alloc;
be91128c579c86d Joshua Hay 2025-07-08 75 }
be91128c579c86d Joshua Hay 2025-07-08 76 adev->id = ret;
be91128c579c86d Joshua Hay 2025-07-08 @77 adev->dev.release = idpf_vport_adev_release;
be91128c579c86d Joshua Hay 2025-07-08 78 adev->dev.parent = &cdev_info->pdev->dev;
be91128c579c86d Joshua Hay 2025-07-08 79 sprintf(name, "%04x.rdma.vdev", cdev_info->pdev->vendor);
be91128c579c86d Joshua Hay 2025-07-08 80 adev->name = name;
be91128c579c86d Joshua Hay 2025-07-08 81
be91128c579c86d Joshua Hay 2025-07-08 82 ret = auxiliary_device_init(adev);
be91128c579c86d Joshua Hay 2025-07-08 83 if (ret)
be91128c579c86d Joshua Hay 2025-07-08 84 goto err_aux_dev_init;
be91128c579c86d Joshua Hay 2025-07-08 85
be91128c579c86d Joshua Hay 2025-07-08 86 ret = auxiliary_device_add(adev);
be91128c579c86d Joshua Hay 2025-07-08 87 if (ret)
be91128c579c86d Joshua Hay 2025-07-08 88 goto err_aux_dev_add;
be91128c579c86d Joshua Hay 2025-07-08 89
be91128c579c86d Joshua Hay 2025-07-08 90 return 0;
be91128c579c86d Joshua Hay 2025-07-08 91
be91128c579c86d Joshua Hay 2025-07-08 92 err_aux_dev_add:
be91128c579c86d Joshua Hay 2025-07-08 93 auxiliary_device_uninit(adev);
be91128c579c86d Joshua Hay 2025-07-08 94 err_aux_dev_init:
be91128c579c86d Joshua Hay 2025-07-08 @95 ida_free(&idpf_idc_ida, adev->id);
be91128c579c86d Joshua Hay 2025-07-08 96 err_ida_alloc:
be91128c579c86d Joshua Hay 2025-07-08 97 vdev_info->adev = NULL;
be91128c579c86d Joshua Hay 2025-07-08 98 kfree(iadev);
be91128c579c86d Joshua Hay 2025-07-08 99
be91128c579c86d Joshua Hay 2025-07-08 100 return ret;
be91128c579c86d Joshua Hay 2025-07-08 101 }
be91128c579c86d Joshua Hay 2025-07-08 102
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-05-14 13:02 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202605142014.gNPFJ2JV-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.