From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f53.google.com (mail-wr1-f53.google.com [209.85.221.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9FA8D3DD86E for ; Thu, 14 May 2026 08:47:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778748454; cv=none; b=IkRmox20JNslPeLJtrQRRCu/P3GhAVVs4hEBnk8nRKL59c6TFgmLTKZzJuEhdKwAcbacBx77B78fJ5KmjkyepisXngDxkDuvahnim0kob8zqLjjR2YsY0TZonf7FNw9zcg00mZNliVrqLQPKe1N0bHVDp+rPY5fO2uNQASiYgNw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778748454; c=relaxed/simple; bh=/M4O9MdEk7wkh/g9A5rB6DDLkw3Hh00ADHbqT+hBwrA=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=Fz1/KIqiBiwpwMz+DX4hkgUm757WeyVo4n2YgeOTPezibn8dtLPhkh5NxwKL6QN5cCPM+9HqFpvTbjF6aL4qZxSLArO9st2qvC8hDatn+YV3cmt1RC04H/68mbffqr/laXmTKJ9fazm+Uf5hConQ7xi86VXtE/rQ+P7uI9rPzCE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QOa/oDq3; arc=none smtp.client-ip=209.85.221.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QOa/oDq3" Received: by mail-wr1-f53.google.com with SMTP id ffacd0b85a97d-44b052142e1so4331640f8f.1 for ; Thu, 14 May 2026 01:47:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778748449; x=1779353249; darn=vger.kernel.org; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=FruKmvkekS8OQpchFD41wcI4xO6AhYjyTf5iNxETto0=; b=QOa/oDq3pxRzX9h193aqEqgrJztQV7QPjJAgge2o9v5vl9IpXFJCgP0damFkNYPubD Nv4QTe5i7aWjuwnZ074DgEIAH8c6rwAQmZGveeZtkHB/RS3tNHvqqCQf3pu/XHC0JPim IepqgcLn/PmTO7TtFk58Nwpe8eM9I2efNrbltyU0NpDBXr4TSugbYXJY7Gf9pA8HSR7G lhyWNEmNlGWEMOQNanxXuWJxo+IjZiXL32QKNBM7ITcGI64Q8VUDjkQgkUXvyD1+HZQy ObQVORPg/rWF9f6ged7reHqWmoQ/qBlCL/coF98QszrAX6pEp/m403pvtIimX8RnrtXy /+/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778748449; x=1779353249; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=FruKmvkekS8OQpchFD41wcI4xO6AhYjyTf5iNxETto0=; b=qxPv09LhS4TEuNhb9/+fZGM1XMpSabd2nyKyv4Ds+x7i4ZF6a80LB3fRtOZHWe234l 1o7DmUQWH9ytMFGant7zBVXdU2YftgeICM8yeDhPwhUDFe8GzxuyYwbBAbtA4emLVPIV wmMCumcWI8XyljtIzEiFj63HdhVZq/9UNeUO8IAJnqR7BSkwfRe+LdxctZ62RQLIRK33 JoSQi93yRqimOcHx6VoXvaQMi7QSk3t/I/OAle8+Mfz/gRVGkfkztslzsaOpuM3R9Wat TAQtsESdZ+9dFKf7yBH0fDoD77qULrVFlnRM5uaV+o9b6wxP6pDLpJwm1ZcWE4f8l2SN tfOg== X-Forwarded-Encrypted: i=1; AFNElJ91v4WniboI/ThzQcGTE5cogHXwED3LaXHfd+xTUk6WfP5KX8y82GTp/UdPelnnPqELFS5vs74KAbLSc+0=@vger.kernel.org X-Gm-Message-State: AOJu0YyQPGHlynqis93WO+hPQ5s/zMXEw8kMAol++jkB12s6xpwBzn4c VmL5ko9wUOfiyPYzoMz4lanT2Vp8Kx4KjEMD5SlYTBYhWdeyxOPma1fm X-Gm-Gg: Acq92OFruEsBv5FTTeuFEj/xdpCO4aVPUMdsFSKBiTsO3do3DwEhMpprwxgdy197sIO Ah+EJKDGnshESoxayvhY0rgaGLRxA3ioE+ZpDEfEcUjNgZLG4QNe5Rl3BHkSFm8gVhezG2a2oMm zv99YB5jUXuL34H2spfg5YkSHgyoDBoo0BPjC1JpD2w49+zzugzZnPDcoHOkobEAKLTjSexZCJn XLOyiABIRwo/kthSC2nSQTkmiSnqdtuYAoCehXnE401wWwxjT3LzyIM/791gGN7jgqyPAu+TOhf jjfHyvYugRdQCBEMvKjejtF3jt6iMV9OOp4Ajqn2lyWXBzzeHXaRpZ/byKQUIuH1Lw7rUSSeUOP MZHjqPeCrNGZzxX7DCD37U6mzwDm9/jDG9aVWaH3SBpxzd8HHZODKo16fDPmfCglyQV0sdViMx/ 1RqFi4y6Ieqip7EvNhO5g= X-Received: by 2002:a05:6000:24c3:b0:45b:d891:4ef1 with SMTP id ffacd0b85a97d-45c597030d7mr10665791f8f.34.1778748449454; Thu, 14 May 2026 01:47:29 -0700 (PDT) Received: from localhost ([196.207.164.177]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-45d9e768072sm5181999f8f.5.2026.05.14.01.47.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 14 May 2026 01:47:28 -0700 (PDT) Date: Thu, 14 May 2026 11:47:25 +0300 From: Dan Carpenter To: oe-kbuild@lists.linux.dev, Joshua Hay Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev, linux-kernel@vger.kernel.org, Tony Nguyen , Madhu Chittim , Tatyana Nikolova Subject: drivers/net/ethernet/intel/idpf/idpf_idc.c:93 idpf_plug_core_aux_dev() error: dereferencing freed memory 'adev' (line 75) Message-ID: <202605141659.ITAp29HS-lkp@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: e1914add2799225a87502051415fc5c32aeb02ae commit: f4312e6bfa2a98e94dacc75f96f916b76bdf4259 idpf: implement core RDMA auxiliary dev create, init, and destroy config: i386-randconfig-141-20260514 (https://download.01.org/0day-ci/archive/20260514/202605141659.ITAp29HS-lkp@intel.com/config) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) smatch: v0.5.0-9185-gbcc58b9c If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Fixes: f4312e6bfa2a ("idpf: implement core RDMA auxiliary dev create, init, and destroy") | Reported-by: kernel test robot | Reported-by: Dan Carpenter | Closes: https://lore.kernel.org/r/202605141659.ITAp29HS-lkp@intel.com/ smatch warnings: drivers/net/ethernet/intel/idpf/idpf_idc.c:93 idpf_plug_core_aux_dev() error: dereferencing freed memory 'adev' (line 75) vim +/adev +93 drivers/net/ethernet/intel/idpf/idpf_idc.c f4312e6bfa2a98 Joshua Hay 2025-07-08 54 static int idpf_plug_core_aux_dev(struct iidc_rdma_core_dev_info *cdev_info) f4312e6bfa2a98 Joshua Hay 2025-07-08 55 { f4312e6bfa2a98 Joshua Hay 2025-07-08 56 struct iidc_rdma_core_auxiliary_dev *iadev; f4312e6bfa2a98 Joshua Hay 2025-07-08 57 char name[IDPF_IDC_MAX_ADEV_NAME_LEN]; f4312e6bfa2a98 Joshua Hay 2025-07-08 58 struct auxiliary_device *adev; f4312e6bfa2a98 Joshua Hay 2025-07-08 59 int ret; f4312e6bfa2a98 Joshua Hay 2025-07-08 60 f4312e6bfa2a98 Joshua Hay 2025-07-08 61 iadev = kzalloc(sizeof(*iadev), GFP_KERNEL); f4312e6bfa2a98 Joshua Hay 2025-07-08 62 if (!iadev) f4312e6bfa2a98 Joshua Hay 2025-07-08 63 return -ENOMEM; f4312e6bfa2a98 Joshua Hay 2025-07-08 64 f4312e6bfa2a98 Joshua Hay 2025-07-08 65 adev = &iadev->adev; f4312e6bfa2a98 Joshua Hay 2025-07-08 66 cdev_info->adev = adev; f4312e6bfa2a98 Joshua Hay 2025-07-08 67 iadev->cdev_info = cdev_info; f4312e6bfa2a98 Joshua Hay 2025-07-08 68 f4312e6bfa2a98 Joshua Hay 2025-07-08 69 ret = ida_alloc(&idpf_idc_ida, GFP_KERNEL); f4312e6bfa2a98 Joshua Hay 2025-07-08 70 if (ret < 0) { f4312e6bfa2a98 Joshua Hay 2025-07-08 71 pr_err("failed to allocate unique device ID for Auxiliary driver\n"); f4312e6bfa2a98 Joshua Hay 2025-07-08 72 goto err_ida_alloc; f4312e6bfa2a98 Joshua Hay 2025-07-08 73 } f4312e6bfa2a98 Joshua Hay 2025-07-08 74 adev->id = ret; f4312e6bfa2a98 Joshua Hay 2025-07-08 @75 adev->dev.release = idpf_core_adev_release; f4312e6bfa2a98 Joshua Hay 2025-07-08 76 adev->dev.parent = &cdev_info->pdev->dev; f4312e6bfa2a98 Joshua Hay 2025-07-08 77 sprintf(name, "%04x.rdma.core", cdev_info->pdev->vendor); f4312e6bfa2a98 Joshua Hay 2025-07-08 78 adev->name = name; f4312e6bfa2a98 Joshua Hay 2025-07-08 79 f4312e6bfa2a98 Joshua Hay 2025-07-08 80 ret = auxiliary_device_init(adev); f4312e6bfa2a98 Joshua Hay 2025-07-08 81 if (ret) f4312e6bfa2a98 Joshua Hay 2025-07-08 82 goto err_aux_dev_init; f4312e6bfa2a98 Joshua Hay 2025-07-08 83 f4312e6bfa2a98 Joshua Hay 2025-07-08 84 ret = auxiliary_device_add(adev); f4312e6bfa2a98 Joshua Hay 2025-07-08 85 if (ret) f4312e6bfa2a98 Joshua Hay 2025-07-08 86 goto err_aux_dev_add; f4312e6bfa2a98 Joshua Hay 2025-07-08 87 f4312e6bfa2a98 Joshua Hay 2025-07-08 88 return 0; f4312e6bfa2a98 Joshua Hay 2025-07-08 89 f4312e6bfa2a98 Joshua Hay 2025-07-08 90 err_aux_dev_add: f4312e6bfa2a98 Joshua Hay 2025-07-08 91 auxiliary_device_uninit(adev); f4312e6bfa2a98 Joshua Hay 2025-07-08 92 err_aux_dev_init: f4312e6bfa2a98 Joshua Hay 2025-07-08 @93 ida_free(&idpf_idc_ida, adev->id); ^^^^^^^^^ I could have sworn I saw patches to fix this use after free months ago but it's still a bug in net-next. idpf_core_adev_release() frees iadev and adev is a to inside iadev. f4312e6bfa2a98 Joshua Hay 2025-07-08 94 err_ida_alloc: f4312e6bfa2a98 Joshua Hay 2025-07-08 95 cdev_info->adev = NULL; f4312e6bfa2a98 Joshua Hay 2025-07-08 96 kfree(iadev); f4312e6bfa2a98 Joshua Hay 2025-07-08 97 f4312e6bfa2a98 Joshua Hay 2025-07-08 98 return ret; f4312e6bfa2a98 Joshua Hay 2025-07-08 99 } -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki