From: Dan Carpenter <dan.carpenter@linaro.org>
To: oe-kbuild@lists.linux.dev, Yaxing Guo <guoyaxing@bosc.ac.cn>
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev,
linux-kernel@vger.kernel.org
Subject: drivers/uio/uio_pci_generic_sva.c:140 probe() warn: passing devm_ allocated variable to kfree. 'udev'
Date: Sat, 21 Mar 2026 11:24:08 +0300 [thread overview]
Message-ID: <202603210811.1eXTfndx-lkp@intel.com> (raw)
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 42bddab0563fe67882b2722620a66dd98c8dbf33
commit: 3397c3cd859a2c51962ad032dcf97961d42f9db2 uio: Add SVA support for PCI devices via uio_pci_generic_sva.c
config: x86_64-randconfig-161-20260321 (https://download.01.org/0day-ci/archive/20260321/202603210811.1eXTfndx-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
smatch: v0.5.0-9004-gb810ac53
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202603210811.1eXTfndx-lkp@intel.com/
New smatch warnings:
drivers/uio/uio_pci_generic_sva.c:140 probe() warn: passing devm_ allocated variable to kfree. 'udev'
vim +/udev +140 drivers/uio/uio_pci_generic_sva.c
3397c3cd859a2c Yaxing Guo 2025-09-26 62 static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
3397c3cd859a2c Yaxing Guo 2025-09-26 63 {
3397c3cd859a2c Yaxing Guo 2025-09-26 64 struct uio_pci_sva_dev *udev;
3397c3cd859a2c Yaxing Guo 2025-09-26 65 int ret, i, irq = 0;
3397c3cd859a2c Yaxing Guo 2025-09-26 66
3397c3cd859a2c Yaxing Guo 2025-09-26 67 ret = pci_enable_device(pdev);
3397c3cd859a2c Yaxing Guo 2025-09-26 68 if (ret) {
3397c3cd859a2c Yaxing Guo 2025-09-26 69 dev_err(&pdev->dev, "pci_enable_device failed: %d\n", ret);
3397c3cd859a2c Yaxing Guo 2025-09-26 70 return ret;
3397c3cd859a2c Yaxing Guo 2025-09-26 71 }
3397c3cd859a2c Yaxing Guo 2025-09-26 72
3397c3cd859a2c Yaxing Guo 2025-09-26 73 ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
3397c3cd859a2c Yaxing Guo 2025-09-26 74 if (ret)
3397c3cd859a2c Yaxing Guo 2025-09-26 75 goto out_disable;
3397c3cd859a2c Yaxing Guo 2025-09-26 76
3397c3cd859a2c Yaxing Guo 2025-09-26 77 pci_set_master(pdev);
3397c3cd859a2c Yaxing Guo 2025-09-26 78
3397c3cd859a2c Yaxing Guo 2025-09-26 79 ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_MSIX | PCI_IRQ_MSI);
3397c3cd859a2c Yaxing Guo 2025-09-26 80 if (ret > 0) {
3397c3cd859a2c Yaxing Guo 2025-09-26 81 irq = pci_irq_vector(pdev, 0);
3397c3cd859a2c Yaxing Guo 2025-09-26 82 if (irq < 0) {
3397c3cd859a2c Yaxing Guo 2025-09-26 83 dev_err(&pdev->dev, "Failed to get MSI vector\n");
3397c3cd859a2c Yaxing Guo 2025-09-26 84 ret = irq;
3397c3cd859a2c Yaxing Guo 2025-09-26 85 goto out_disable;
3397c3cd859a2c Yaxing Guo 2025-09-26 86 }
3397c3cd859a2c Yaxing Guo 2025-09-26 87 } else
3397c3cd859a2c Yaxing Guo 2025-09-26 88 dev_warn(&pdev->dev,
3397c3cd859a2c Yaxing Guo 2025-09-26 89 "No IRQ vectors available (%d), using polling\n", ret);
3397c3cd859a2c Yaxing Guo 2025-09-26 90
3397c3cd859a2c Yaxing Guo 2025-09-26 91 udev = devm_kzalloc(&pdev->dev, sizeof(struct uio_pci_sva_dev),
3397c3cd859a2c Yaxing Guo 2025-09-26 92 GFP_KERNEL);
udev is devm_ memory.
3397c3cd859a2c Yaxing Guo 2025-09-26 93 if (!udev) {
3397c3cd859a2c Yaxing Guo 2025-09-26 94 ret = -ENOMEM;
3397c3cd859a2c Yaxing Guo 2025-09-26 95 goto out_disable;
3397c3cd859a2c Yaxing Guo 2025-09-26 96 }
3397c3cd859a2c Yaxing Guo 2025-09-26 97
[ snip ]
3397c3cd859a2c Yaxing Guo 2025-09-26 129 ret = devm_uio_register_device(&pdev->dev, &udev->info);
3397c3cd859a2c Yaxing Guo 2025-09-26 130 if (ret) {
3397c3cd859a2c Yaxing Guo 2025-09-26 131 dev_err(&pdev->dev, "Failed to register uio device\n");
3397c3cd859a2c Yaxing Guo 2025-09-26 132 goto out_free;
3397c3cd859a2c Yaxing Guo 2025-09-26 133 }
3397c3cd859a2c Yaxing Guo 2025-09-26 134
3397c3cd859a2c Yaxing Guo 2025-09-26 135 pci_set_drvdata(pdev, udev);
3397c3cd859a2c Yaxing Guo 2025-09-26 136
3397c3cd859a2c Yaxing Guo 2025-09-26 137 return 0;
3397c3cd859a2c Yaxing Guo 2025-09-26 138
3397c3cd859a2c Yaxing Guo 2025-09-26 139 out_free:
3397c3cd859a2c Yaxing Guo 2025-09-26 @140 kfree(udev);
So this is a double free.
3397c3cd859a2c Yaxing Guo 2025-09-26 141 out_disable:
3397c3cd859a2c Yaxing Guo 2025-09-26 142 pci_disable_device(pdev);
3397c3cd859a2c Yaxing Guo 2025-09-26 143
3397c3cd859a2c Yaxing Guo 2025-09-26 144 return ret;
3397c3cd859a2c Yaxing Guo 2025-09-26 145 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-03-21 8:24 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-21 8:24 Dan Carpenter [this message]
2026-03-21 9:51 ` drivers/uio/uio_pci_generic_sva.c:140 probe() warn: passing devm_ allocated variable to kfree. 'udev' yaxing guo
2026-03-21 10:22 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202603210811.1eXTfndx-lkp@intel.com \
--to=dan.carpenter@linaro.org \
--cc=guoyaxing@bosc.ac.cn \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@intel.com \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox