From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [jimc:dyndbg-maple-clean 45/45] lib/dynamic_debug.c:1962 ddebug_reconstruct_site_map() error: double free of 'decompressed_sites' (line 1940)
Date: Wed, 23 Sep 2026 11:47:20 +0200 [thread overview]
Message-ID: <202609231115.ZePNk5fP-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Jim Cromie <jim.cromie@gmail.com>
TO: "Łukasz Bartosik" <ukaszb@chromium.org>
tree: https://github.com/jimc/linux.git dyndbg-maple-clean
head: 66849149b0a8cab7cdac143b22fd88b3df05636b
commit: 66849149b0a8cab7cdac143b22fd88b3df05636b [45/45] dyndbg: Compress site-data with zstd and reclaim trees via shrinker
:::::: branch date: 4 days ago
:::::: commit date: 4 days ago
config: x86_64-randconfig-2200-20260923 (https://download.01.org/0day-ci/archive/20260923/202609231115.ZePNk5fP-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202609231115.ZePNk5fP-lkp@intel.com/
New smatch warnings:
lib/dynamic_debug.c:1962 ddebug_reconstruct_site_map() error: double free of 'decompressed_sites' (line 1940)
Old smatch warnings:
lib/dynamic_debug.c:965 param_set_dyndbg_module_classes() error: we previously assumed 'map' could be null (see line 952)
vim +/decompressed_sites +1962 lib/dynamic_debug.c
66849149b0a8ca Jim Cromie 2026-07-08 1913
66849149b0a8ca Jim Cromie 2026-07-08 1914 static int ddebug_reconstruct_site_map(void)
66849149b0a8ca Jim Cromie 2026-07-08 1915 {
66849149b0a8ca Jim Cromie 2026-07-08 1916 struct ddebug_table *dt;
66849149b0a8ca Jim Cromie 2026-07-08 1917 struct _ddebug_info di;
66849149b0a8ca Jim Cromie 2026-07-08 1918 struct _ddebug_site *decompressed_sites = NULL;
66849149b0a8ca Jim Cromie 2026-07-08 1919 int ret;
66849149b0a8ca Jim Cromie 2026-07-08 1920
66849149b0a8ca Jim Cromie 2026-07-08 1921 if (!mtree_empty(&dd_site_map))
66849149b0a8ca Jim Cromie 2026-07-08 1922 return 0;
66849149b0a8ca Jim Cromie 2026-07-08 1923
66849149b0a8ca Jim Cromie 2026-07-08 1924 /* 1. Reconstruct built-in site map */
66849149b0a8ca Jim Cromie 2026-07-08 1925 if (dd_builtin_compressed_sites) {
66849149b0a8ca Jim Cromie 2026-07-08 1926 unsigned int count = __stop___dyndbg_descs - __start___dyndbg_descs;
66849149b0a8ca Jim Cromie 2026-07-08 1927
66849149b0a8ca Jim Cromie 2026-07-08 1928 ret = ddebug_decompress_sites(dd_builtin_compressed_sites,
66849149b0a8ca Jim Cromie 2026-07-08 1929 dd_builtin_compressed_len,
66849149b0a8ca Jim Cromie 2026-07-08 1930 &decompressed_sites, count);
66849149b0a8ca Jim Cromie 2026-07-08 1931 if (ret)
66849149b0a8ca Jim Cromie 2026-07-08 1932 return ret;
66849149b0a8ca Jim Cromie 2026-07-08 1933
66849149b0a8ca Jim Cromie 2026-07-08 1934 di.descs.start = __start___dyndbg_descs;
66849149b0a8ca Jim Cromie 2026-07-08 1935 di.descs.len = count;
66849149b0a8ca Jim Cromie 2026-07-08 1936 di.sites.start = decompressed_sites;
66849149b0a8ca Jim Cromie 2026-07-08 1937 di.sites.len = count;
66849149b0a8ca Jim Cromie 2026-07-08 1938
66849149b0a8ca Jim Cromie 2026-07-08 1939 ddebug_condense_sites(&di);
66849149b0a8ca Jim Cromie 2026-07-08 @1940 kvfree(decompressed_sites);
66849149b0a8ca Jim Cromie 2026-07-08 1941 }
66849149b0a8ca Jim Cromie 2026-07-08 1942
66849149b0a8ca Jim Cromie 2026-07-08 1943 /* 2. Reconstruct loadable module site maps */
66849149b0a8ca Jim Cromie 2026-07-08 1944 list_for_each_entry(dt, &ddebug_tables, link) {
66849149b0a8ca Jim Cromie 2026-07-08 1945 if (dt->info.descs.start >= __start___dyndbg_descs &&
66849149b0a8ca Jim Cromie 2026-07-08 1946 dt->info.descs.start < __stop___dyndbg_descs)
66849149b0a8ca Jim Cromie 2026-07-08 1947 continue;
66849149b0a8ca Jim Cromie 2026-07-08 1948
66849149b0a8ca Jim Cromie 2026-07-08 1949 if (dt->compressed_sites) {
66849149b0a8ca Jim Cromie 2026-07-08 1950 ret = ddebug_decompress_sites(dt->compressed_sites,
66849149b0a8ca Jim Cromie 2026-07-08 1951 dt->compressed_len,
66849149b0a8ca Jim Cromie 2026-07-08 1952 &decompressed_sites,
66849149b0a8ca Jim Cromie 2026-07-08 1953 dt->info.descs.len);
66849149b0a8ca Jim Cromie 2026-07-08 1954 if (ret)
66849149b0a8ca Jim Cromie 2026-07-08 1955 continue;
66849149b0a8ca Jim Cromie 2026-07-08 1956
66849149b0a8ca Jim Cromie 2026-07-08 1957 di = dt->info;
66849149b0a8ca Jim Cromie 2026-07-08 1958 di.sites.start = decompressed_sites;
66849149b0a8ca Jim Cromie 2026-07-08 1959 di.sites.len = dt->info.descs.len;
66849149b0a8ca Jim Cromie 2026-07-08 1960
66849149b0a8ca Jim Cromie 2026-07-08 1961 ddebug_condense_sites(&di);
66849149b0a8ca Jim Cromie 2026-07-08 @1962 kvfree(decompressed_sites);
66849149b0a8ca Jim Cromie 2026-07-08 1963 }
66849149b0a8ca Jim Cromie 2026-07-08 1964 }
66849149b0a8ca Jim Cromie 2026-07-08 1965
66849149b0a8ca Jim Cromie 2026-07-08 1966 return 0;
66849149b0a8ca Jim Cromie 2026-07-08 1967 }
a07d3696825a7a Jim Cromie 2026-09-06 1968 static void ddebug_condense_sites(struct _ddebug_info *di)
a07d3696825a7a Jim Cromie 2026-09-06 1969 {
a07d3696825a7a Jim Cromie 2026-09-06 1970 int funcs = 0, files = 0, mods = 0;
a07d3696825a7a Jim Cromie 2026-09-06 1971
a07d3696825a7a Jim Cromie 2026-09-06 1972 if (!di->sites.len)
a07d3696825a7a Jim Cromie 2026-09-06 1973 return;
a07d3696825a7a Jim Cromie 2026-09-06 1974
a07d3696825a7a Jim Cromie 2026-09-06 1975 if (WARN_ON(di->descs.len != di->sites.len))
a07d3696825a7a Jim Cromie 2026-09-06 1976 return;
a07d3696825a7a Jim Cromie 2026-09-06 1977
a07d3696825a7a Jim Cromie 2026-09-06 1978 funcs = ddebug_grow_tree(di, &dd_site_map,
a07d3696825a7a Jim Cromie 2026-09-06 1979 "func", ddebug_get_function, DD_TAG_FUNC);
a07d3696825a7a Jim Cromie 2026-09-06 1980 files = ddebug_grow_tree(di, &dd_site_map,
a07d3696825a7a Jim Cromie 2026-09-06 1981 "file", ddebug_get_filename, DD_TAG_FILE);
a07d3696825a7a Jim Cromie 2026-09-06 1982 mods = ddebug_grow_tree(di, &dd_site_map,
a07d3696825a7a Jim Cromie 2026-09-06 1983 "mod", ddebug_get_modname, DD_TAG_MOD);
a07d3696825a7a Jim Cromie 2026-09-06 1984
a07d3696825a7a Jim Cromie 2026-09-06 1985 ddebug_log_compression_stats(di->descs.len, mods, files, funcs);
a07d3696825a7a Jim Cromie 2026-09-06 1986 di->sites.len = 0;
a07d3696825a7a Jim Cromie 2026-09-06 1987 }
a07d3696825a7a Jim Cromie 2026-09-06 1988
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-09-23 9:48 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202609231115.ZePNk5fP-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.