Re: [PATCH] qmi: avoid free of non heap object

[Denis Kenzior <denkenz@gmail.com>]

Hi Sean,

On 6/26/25 3:16 AM, Sean Nyekjaer wrote:
> qmux_create_client_timeout() free's a non heap object, avoid calling
> __request_free() and inline free_request() instead.
> 
> In function 'l_free',
>      inlined from '__request_free' at drivers/qmimodem/qmi.c:293:3,
>      inlined from 'qmux_create_client_timeout' at drivers/qmimodem/qmi.c:1427:2:
> ell/util.c:124:9: warning: 'free' called on pointer 'user_data_6(D)' with nonzero offset 28 [-Wfree-nonheap-object]
>    124 |         free(ptr);
>        |         ^

Hmm, what tool is producing this output?

> ---
>   drivers/qmimodem/qmi.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/qmimodem/qmi.c b/drivers/qmimodem/qmi.c
> index 5d2553c5..4468761a 100644
> --- a/drivers/qmimodem/qmi.c
> +++ b/drivers/qmimodem/qmi.c
> @@ -1424,7 +1424,9 @@ static void qmux_create_client_timeout(struct l_timeout *timeout,
>   
>   	/* remove request from queues */
>   	find_control_request(qmux, req->super.tid);
> -	__request_free(&req->super);
> +
> +	if (req->super.free_request)
> +		req->super.free_request(&req->super);

This must be some sort of false positive.  In qmi_qmux_device_create_client() we 
always set .free_request, so __request_free will never take the l_free() branch.

The question is whether a compiler is producing this output or some static 
analysis tool?

>   }
>   
>   static void qmux_create_client_callback(struct qmi_request *r,

Regards,
-Denis