* drivers/uio/uio_pci_generic_sva.c:140 probe() warn: passing devm_ allocated variable to kfree. 'udev'
@ 2026-03-21 8:24 Dan Carpenter
2026-03-21 9:51 ` yaxing guo
0 siblings, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2026-03-21 8:24 UTC (permalink / raw)
To: oe-kbuild, Yaxing Guo; +Cc: lkp, oe-kbuild-all, linux-kernel
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 42bddab0563fe67882b2722620a66dd98c8dbf33
commit: 3397c3cd859a2c51962ad032dcf97961d42f9db2 uio: Add SVA support for PCI devices via uio_pci_generic_sva.c
config: x86_64-randconfig-161-20260321 (https://download.01.org/0day-ci/archive/20260321/202603210811.1eXTfndx-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
smatch: v0.5.0-9004-gb810ac53
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202603210811.1eXTfndx-lkp@intel.com/
New smatch warnings:
drivers/uio/uio_pci_generic_sva.c:140 probe() warn: passing devm_ allocated variable to kfree. 'udev'
vim +/udev +140 drivers/uio/uio_pci_generic_sva.c
3397c3cd859a2c Yaxing Guo 2025-09-26 62 static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
3397c3cd859a2c Yaxing Guo 2025-09-26 63 {
3397c3cd859a2c Yaxing Guo 2025-09-26 64 struct uio_pci_sva_dev *udev;
3397c3cd859a2c Yaxing Guo 2025-09-26 65 int ret, i, irq = 0;
3397c3cd859a2c Yaxing Guo 2025-09-26 66
3397c3cd859a2c Yaxing Guo 2025-09-26 67 ret = pci_enable_device(pdev);
3397c3cd859a2c Yaxing Guo 2025-09-26 68 if (ret) {
3397c3cd859a2c Yaxing Guo 2025-09-26 69 dev_err(&pdev->dev, "pci_enable_device failed: %d\n", ret);
3397c3cd859a2c Yaxing Guo 2025-09-26 70 return ret;
3397c3cd859a2c Yaxing Guo 2025-09-26 71 }
3397c3cd859a2c Yaxing Guo 2025-09-26 72
3397c3cd859a2c Yaxing Guo 2025-09-26 73 ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
3397c3cd859a2c Yaxing Guo 2025-09-26 74 if (ret)
3397c3cd859a2c Yaxing Guo 2025-09-26 75 goto out_disable;
3397c3cd859a2c Yaxing Guo 2025-09-26 76
3397c3cd859a2c Yaxing Guo 2025-09-26 77 pci_set_master(pdev);
3397c3cd859a2c Yaxing Guo 2025-09-26 78
3397c3cd859a2c Yaxing Guo 2025-09-26 79 ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_MSIX | PCI_IRQ_MSI);
3397c3cd859a2c Yaxing Guo 2025-09-26 80 if (ret > 0) {
3397c3cd859a2c Yaxing Guo 2025-09-26 81 irq = pci_irq_vector(pdev, 0);
3397c3cd859a2c Yaxing Guo 2025-09-26 82 if (irq < 0) {
3397c3cd859a2c Yaxing Guo 2025-09-26 83 dev_err(&pdev->dev, "Failed to get MSI vector\n");
3397c3cd859a2c Yaxing Guo 2025-09-26 84 ret = irq;
3397c3cd859a2c Yaxing Guo 2025-09-26 85 goto out_disable;
3397c3cd859a2c Yaxing Guo 2025-09-26 86 }
3397c3cd859a2c Yaxing Guo 2025-09-26 87 } else
3397c3cd859a2c Yaxing Guo 2025-09-26 88 dev_warn(&pdev->dev,
3397c3cd859a2c Yaxing Guo 2025-09-26 89 "No IRQ vectors available (%d), using polling\n", ret);
3397c3cd859a2c Yaxing Guo 2025-09-26 90
3397c3cd859a2c Yaxing Guo 2025-09-26 91 udev = devm_kzalloc(&pdev->dev, sizeof(struct uio_pci_sva_dev),
3397c3cd859a2c Yaxing Guo 2025-09-26 92 GFP_KERNEL);
udev is devm_ memory.
3397c3cd859a2c Yaxing Guo 2025-09-26 93 if (!udev) {
3397c3cd859a2c Yaxing Guo 2025-09-26 94 ret = -ENOMEM;
3397c3cd859a2c Yaxing Guo 2025-09-26 95 goto out_disable;
3397c3cd859a2c Yaxing Guo 2025-09-26 96 }
3397c3cd859a2c Yaxing Guo 2025-09-26 97
[ snip ]
3397c3cd859a2c Yaxing Guo 2025-09-26 129 ret = devm_uio_register_device(&pdev->dev, &udev->info);
3397c3cd859a2c Yaxing Guo 2025-09-26 130 if (ret) {
3397c3cd859a2c Yaxing Guo 2025-09-26 131 dev_err(&pdev->dev, "Failed to register uio device\n");
3397c3cd859a2c Yaxing Guo 2025-09-26 132 goto out_free;
3397c3cd859a2c Yaxing Guo 2025-09-26 133 }
3397c3cd859a2c Yaxing Guo 2025-09-26 134
3397c3cd859a2c Yaxing Guo 2025-09-26 135 pci_set_drvdata(pdev, udev);
3397c3cd859a2c Yaxing Guo 2025-09-26 136
3397c3cd859a2c Yaxing Guo 2025-09-26 137 return 0;
3397c3cd859a2c Yaxing Guo 2025-09-26 138
3397c3cd859a2c Yaxing Guo 2025-09-26 139 out_free:
3397c3cd859a2c Yaxing Guo 2025-09-26 @140 kfree(udev);
So this is a double free.
3397c3cd859a2c Yaxing Guo 2025-09-26 141 out_disable:
3397c3cd859a2c Yaxing Guo 2025-09-26 142 pci_disable_device(pdev);
3397c3cd859a2c Yaxing Guo 2025-09-26 143
3397c3cd859a2c Yaxing Guo 2025-09-26 144 return ret;
3397c3cd859a2c Yaxing Guo 2025-09-26 145 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: drivers/uio/uio_pci_generic_sva.c:140 probe() warn: passing devm_ allocated variable to kfree. 'udev'
2026-03-21 8:24 drivers/uio/uio_pci_generic_sva.c:140 probe() warn: passing devm_ allocated variable to kfree. 'udev' Dan Carpenter
@ 2026-03-21 9:51 ` yaxing guo
2026-03-21 10:22 ` Dan Carpenter
0 siblings, 1 reply; 3+ messages in thread
From: yaxing guo @ 2026-03-21 9:51 UTC (permalink / raw)
To: Dan Carpenter, oe-kbuild; +Cc: lkp, oe-kbuild-all, linux-kernel
在 2026/3/21 16:24, Dan Carpenter 写道:
> tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> head: 42bddab0563fe67882b2722620a66dd98c8dbf33
> commit: 3397c3cd859a2c51962ad032dcf97961d42f9db2 uio: Add SVA support for PCI devices via uio_pci_generic_sva.c
> config: x86_64-randconfig-161-20260321 (https://download.01.org/0day-ci/archive/20260321/202603210811.1eXTfndx-lkp@intel.com/config)
> compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
> smatch: v0.5.0-9004-gb810ac53
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> | Closes: https://lore.kernel.org/r/202603210811.1eXTfndx-lkp@intel.com/
>
> New smatch warnings:
> drivers/uio/uio_pci_generic_sva.c:140 probe() warn: passing devm_ allocated variable to kfree. 'udev'
>
> vim +/udev +140 drivers/uio/uio_pci_generic_sva.c
>
> 3397c3cd859a2c Yaxing Guo 2025-09-26 62 static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
> 3397c3cd859a2c Yaxing Guo 2025-09-26 63 {
> 3397c3cd859a2c Yaxing Guo 2025-09-26 64 struct uio_pci_sva_dev *udev;
> 3397c3cd859a2c Yaxing Guo 2025-09-26 65 int ret, i, irq = 0;
> 3397c3cd859a2c Yaxing Guo 2025-09-26 66
> 3397c3cd859a2c Yaxing Guo 2025-09-26 67 ret = pci_enable_device(pdev);
> 3397c3cd859a2c Yaxing Guo 2025-09-26 68 if (ret) {
> 3397c3cd859a2c Yaxing Guo 2025-09-26 69 dev_err(&pdev->dev, "pci_enable_device failed: %d\n", ret);
> 3397c3cd859a2c Yaxing Guo 2025-09-26 70 return ret;
> 3397c3cd859a2c Yaxing Guo 2025-09-26 71 }
> 3397c3cd859a2c Yaxing Guo 2025-09-26 72
> 3397c3cd859a2c Yaxing Guo 2025-09-26 73 ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
> 3397c3cd859a2c Yaxing Guo 2025-09-26 74 if (ret)
> 3397c3cd859a2c Yaxing Guo 2025-09-26 75 goto out_disable;
> 3397c3cd859a2c Yaxing Guo 2025-09-26 76
> 3397c3cd859a2c Yaxing Guo 2025-09-26 77 pci_set_master(pdev);
> 3397c3cd859a2c Yaxing Guo 2025-09-26 78
> 3397c3cd859a2c Yaxing Guo 2025-09-26 79 ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_MSIX | PCI_IRQ_MSI);
> 3397c3cd859a2c Yaxing Guo 2025-09-26 80 if (ret > 0) {
> 3397c3cd859a2c Yaxing Guo 2025-09-26 81 irq = pci_irq_vector(pdev, 0);
> 3397c3cd859a2c Yaxing Guo 2025-09-26 82 if (irq < 0) {
> 3397c3cd859a2c Yaxing Guo 2025-09-26 83 dev_err(&pdev->dev, "Failed to get MSI vector\n");
> 3397c3cd859a2c Yaxing Guo 2025-09-26 84 ret = irq;
> 3397c3cd859a2c Yaxing Guo 2025-09-26 85 goto out_disable;
> 3397c3cd859a2c Yaxing Guo 2025-09-26 86 }
> 3397c3cd859a2c Yaxing Guo 2025-09-26 87 } else
> 3397c3cd859a2c Yaxing Guo 2025-09-26 88 dev_warn(&pdev->dev,
> 3397c3cd859a2c Yaxing Guo 2025-09-26 89 "No IRQ vectors available (%d), using polling\n", ret);
> 3397c3cd859a2c Yaxing Guo 2025-09-26 90
> 3397c3cd859a2c Yaxing Guo 2025-09-26 91 udev = devm_kzalloc(&pdev->dev, sizeof(struct uio_pci_sva_dev),
> 3397c3cd859a2c Yaxing Guo 2025-09-26 92 GFP_KERNEL);
>
> udev is devm_ memory.
>
> 3397c3cd859a2c Yaxing Guo 2025-09-26 93 if (!udev) {
> 3397c3cd859a2c Yaxing Guo 2025-09-26 94 ret = -ENOMEM;
> 3397c3cd859a2c Yaxing Guo 2025-09-26 95 goto out_disable;
> 3397c3cd859a2c Yaxing Guo 2025-09-26 96 }
> 3397c3cd859a2c Yaxing Guo 2025-09-26 97
>
> [ snip ]
>
> 3397c3cd859a2c Yaxing Guo 2025-09-26 129 ret = devm_uio_register_device(&pdev->dev, &udev->info);
> 3397c3cd859a2c Yaxing Guo 2025-09-26 130 if (ret) {
> 3397c3cd859a2c Yaxing Guo 2025-09-26 131 dev_err(&pdev->dev, "Failed to register uio device\n");
> 3397c3cd859a2c Yaxing Guo 2025-09-26 132 goto out_free;
> 3397c3cd859a2c Yaxing Guo 2025-09-26 133 }
> 3397c3cd859a2c Yaxing Guo 2025-09-26 134
> 3397c3cd859a2c Yaxing Guo 2025-09-26 135 pci_set_drvdata(pdev, udev);
> 3397c3cd859a2c Yaxing Guo 2025-09-26 136
> 3397c3cd859a2c Yaxing Guo 2025-09-26 137 return 0;
> 3397c3cd859a2c Yaxing Guo 2025-09-26 138
> 3397c3cd859a2c Yaxing Guo 2025-09-26 139 out_free:
> 3397c3cd859a2c Yaxing Guo 2025-09-26 @140 kfree(udev);
>
> So this is a double free.
>
> 3397c3cd859a2c Yaxing Guo 2025-09-26 141 out_disable:
> 3397c3cd859a2c Yaxing Guo 2025-09-26 142 pci_disable_device(pdev);
> 3397c3cd859a2c Yaxing Guo 2025-09-26 143
> 3397c3cd859a2c Yaxing Guo 2025-09-26 144 return ret;
> 3397c3cd859a2c Yaxing Guo 2025-09-26 145 }
>
Hi Dan,
The double-free issue has been addressed by Shuangshuo Li, who has
already submitted a fix patch:
https://lore.kernel.org/lkml/20260226153250.18079-1-lgs201920130244@gmail.com/
Best regards,
Yaxing Guo
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: drivers/uio/uio_pci_generic_sva.c:140 probe() warn: passing devm_ allocated variable to kfree. 'udev'
2026-03-21 9:51 ` yaxing guo
@ 2026-03-21 10:22 ` Dan Carpenter
0 siblings, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2026-03-21 10:22 UTC (permalink / raw)
To: yaxing guo; +Cc: oe-kbuild, lkp, oe-kbuild-all, linux-kernel
On Sat, Mar 21, 2026 at 05:51:15PM +0800, yaxing guo wrote:
> > 3397c3cd859a2c Yaxing Guo 2025-09-26 135 pci_set_drvdata(pdev, udev);
> > 3397c3cd859a2c Yaxing Guo 2025-09-26 136
> > 3397c3cd859a2c Yaxing Guo 2025-09-26 137 return 0;
> > 3397c3cd859a2c Yaxing Guo 2025-09-26 138
> > 3397c3cd859a2c Yaxing Guo 2025-09-26 139 out_free:
> > 3397c3cd859a2c Yaxing Guo 2025-09-26 @140 kfree(udev);
> >
> > So this is a double free.
> >
> > 3397c3cd859a2c Yaxing Guo 2025-09-26 141 out_disable:
> > 3397c3cd859a2c Yaxing Guo 2025-09-26 142 pci_disable_device(pdev);
> > 3397c3cd859a2c Yaxing Guo 2025-09-26 143
> > 3397c3cd859a2c Yaxing Guo 2025-09-26 144 return ret;
> > 3397c3cd859a2c Yaxing Guo 2025-09-26 145 }
> >
>
> Hi Dan,
> The double-free issue has been addressed by Shuangshuo Li, who has already
> submitted a fix patch:
>
> https://lore.kernel.org/lkml/20260226153250.18079-1-lgs201920130244@gmail.com/
>
Okay. Good. I actually reported this bug to you last year in
November.
https://lore.kernel.org/all/202511280815.WV9iCJZb-lkp@intel.com/
regards,
dan carpenter
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-03-21 10:22 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-21 8:24 drivers/uio/uio_pci_generic_sva.c:140 probe() warn: passing devm_ allocated variable to kfree. 'udev' Dan Carpenter
2026-03-21 9:51 ` yaxing guo
2026-03-21 10:22 ` Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox