[bug report] net: mana: Add support for auxiliary device

[bug report] net: mana: Add support for auxiliary device

[Dan Carpenter]

Hello Long Li,

Commit a69839d4327d ("net: mana: Add support for auxiliary device")
from Nov 3, 2022 (linux-next), leads to the following Smatch static
checker warning:

	drivers/net/ethernet/microsoft/mana/mana_en.c:3893 add_adev()
	warn: 'madev' was already freed. (line 3868)

drivers/net/ethernet/microsoft/mana/mana_en.c
    3848 static int add_adev(struct gdma_dev *gd, const char *name)
    3849 {
    3850         struct auxiliary_device *adev;
    3851         struct mana_adev *madev;
    3852         int ret;
    3853         int id;
    3854 
    3855         madev = kzalloc_obj(*madev);
    3856         if (!madev)
    3857                 return -ENOMEM;
    3858 
    3859         adev = &madev->adev;
    3860         ret = mana_adev_idx_alloc();
    3861         if (ret < 0)
    3862                 goto idx_fail;
    3863         id = ret;
    3864         adev->id = id;
    3865 
    3866         adev->name = name;
    3867         adev->dev.parent = gd->gdma_context->dev;
    3868         adev->dev.release = adev_release;

The adev_release() is assigned here.

    3869         madev->mdev = gd;
    3870 
    3871         ret = auxiliary_device_init(adev);
    3872         if (ret)
    3873                 goto init_fail;
    3874 
    3875         /* madev is owned by the auxiliary device */
    3876         madev = NULL;
    3877         ret = auxiliary_device_add(adev);
    3878         if (ret)
    3879                 goto add_fail;

This goto...

    3880 
    3881         gd->adev = adev;
    3882         dev_dbg(gd->gdma_context->dev,
    3883                 "Auxiliary device added successfully\n");
    3884         return 0;
    3885 
    3886 add_fail:
    3887         auxiliary_device_uninit(adev);

Free adev.

    3888 
    3889 init_fail:
    3890         mana_adev_idx_free(id);
    3891 
    3892 idx_fail:
--> 3893         kfree(madev);

Double free.

    3894 
    3895         return ret;
    3896 }

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter