All of lore.kernel.org
 help / color / mirror / Atom feed
From: Julia Lawall <julia.lawall@inria.fr>
To: Loic Poulain <loic.poulain@linaro.org>,
	gregkh@linuxfoundation.org, kuba@kernel.org, davem@davemloft.net
Cc: aleksander@aleksander.es, linux-arm-msm@vger.kernel.org,
	linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
	bjorn.andersson@linaro.org, manivannan.sadhasivam@linaro.org,
	kbuild-all@lists.01.org
Subject: Re: [PATCH net-next v8 2/2] net: Add Qcom WWAN control driver (fwd)
Date: Sun, 4 Apr 2021 17:31:17 +0200 (CEST)	[thread overview]
Message-ID: <alpine.DEB.2.22.394.2104041729330.2958@hadrien> (raw)

[-- Attachment #1: Type: text/plain, Size: 4252 bytes --]

There is a clear use after free on line 213.

julia

---------- Forwarded message ----------
Date: Sat, 3 Apr 2021 04:42:45 +0800
From: kernel test robot <lkp@intel.com>
To: kbuild@lists.01.org
Cc: lkp@intel.com, Julia Lawall <julia.lawall@lip6.fr>
Subject: Re: [PATCH net-next v8 2/2] net: Add Qcom WWAN control driver

CC: kbuild-all@lists.01.org
In-Reply-To: <1617372397-13988-2-git-send-email-loic.poulain@linaro.org>
References: <1617372397-13988-2-git-send-email-loic.poulain@linaro.org>
TO: Loic Poulain <loic.poulain@linaro.org>
TO: gregkh@linuxfoundation.org
TO: kuba@kernel.org
TO: davem@davemloft.net
CC: linux-arm-msm@vger.kernel.org
CC: aleksander@aleksander.es
CC: linux-kernel@vger.kernel.org
CC: netdev@vger.kernel.org
CC: bjorn.andersson@linaro.org
CC: manivannan.sadhasivam@linaro.org
CC: Loic Poulain <loic.poulain@linaro.org>

Hi Loic,

I love your patch! Perhaps something to improve:

[auto build test WARNING on net-next/master]

url:    https://github.com/0day-ci/linux/commits/Loic-Poulain/net-Add-a-WWAN-subsystem/20210402-220002
base:   https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git bd78980be1a68d14524c51c4b4170782fada622b
:::::: branch date: 7 hours ago
:::::: commit date: 7 hours ago
config: i386-allyesconfig (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@lip6.fr>


cocci warnings: (new ones prefixed by >>)
>> drivers/net/wwan/mhi_wwan_ctrl.c:213:17-24: ERROR: reference preceded by free on line 212

vim +213 drivers/net/wwan/mhi_wwan_ctrl.c

16d753f4f524ce Loic Poulain 2021-04-02  184
16d753f4f524ce Loic Poulain 2021-04-02  185  static int mhi_wwan_ctrl_probe(struct mhi_device *mhi_dev,
16d753f4f524ce Loic Poulain 2021-04-02  186  			       const struct mhi_device_id *id)
16d753f4f524ce Loic Poulain 2021-04-02  187  {
16d753f4f524ce Loic Poulain 2021-04-02  188  	struct mhi_controller *cntrl = mhi_dev->mhi_cntrl;
16d753f4f524ce Loic Poulain 2021-04-02  189  	struct mhi_wwan_dev *mhiwwan;
16d753f4f524ce Loic Poulain 2021-04-02  190
16d753f4f524ce Loic Poulain 2021-04-02  191  	mhiwwan = kzalloc(sizeof(*mhiwwan), GFP_KERNEL);
16d753f4f524ce Loic Poulain 2021-04-02  192  	if (!mhiwwan)
16d753f4f524ce Loic Poulain 2021-04-02  193  		return -ENOMEM;
16d753f4f524ce Loic Poulain 2021-04-02  194
16d753f4f524ce Loic Poulain 2021-04-02  195  	mhiwwan->mhi_dev = mhi_dev;
16d753f4f524ce Loic Poulain 2021-04-02  196  	mhiwwan->mtu = MHI_WWAN_MAX_MTU;
16d753f4f524ce Loic Poulain 2021-04-02  197  	INIT_WORK(&mhiwwan->rx_refill, mhi_wwan_ctrl_refill_work);
16d753f4f524ce Loic Poulain 2021-04-02  198  	spin_lock_init(&mhiwwan->tx_lock);
16d753f4f524ce Loic Poulain 2021-04-02  199
16d753f4f524ce Loic Poulain 2021-04-02  200  	if (mhi_dev->dl_chan)
16d753f4f524ce Loic Poulain 2021-04-02  201  		set_bit(MHI_WWAN_DL_CAP, &mhiwwan->flags);
16d753f4f524ce Loic Poulain 2021-04-02  202  	if (mhi_dev->ul_chan)
16d753f4f524ce Loic Poulain 2021-04-02  203  		set_bit(MHI_WWAN_UL_CAP, &mhiwwan->flags);
16d753f4f524ce Loic Poulain 2021-04-02  204
16d753f4f524ce Loic Poulain 2021-04-02  205  	dev_set_drvdata(&mhi_dev->dev, mhiwwan);
16d753f4f524ce Loic Poulain 2021-04-02  206
16d753f4f524ce Loic Poulain 2021-04-02  207  	/* Register as a wwan port, id->driver_data contains wwan port type */
16d753f4f524ce Loic Poulain 2021-04-02  208  	mhiwwan->wwan_port = wwan_create_port(&cntrl->mhi_dev->dev,
16d753f4f524ce Loic Poulain 2021-04-02  209  					      id->driver_data,
16d753f4f524ce Loic Poulain 2021-04-02  210  					      &wwan_pops, mhiwwan);
16d753f4f524ce Loic Poulain 2021-04-02  211  	if (IS_ERR(mhiwwan->wwan_port)) {
16d753f4f524ce Loic Poulain 2021-04-02 @212  		kfree(mhiwwan);
16d753f4f524ce Loic Poulain 2021-04-02 @213  		return PTR_ERR(mhiwwan->wwan_port);
16d753f4f524ce Loic Poulain 2021-04-02  214  	}
16d753f4f524ce Loic Poulain 2021-04-02  215
16d753f4f524ce Loic Poulain 2021-04-02  216  	return 0;
16d753f4f524ce Loic Poulain 2021-04-02  217  };
16d753f4f524ce Loic Poulain 2021-04-02  218

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org

[-- Attachment #2: Type: application/gzip, Size: 65078 bytes --]

WARNING: multiple messages have this Message-ID (diff)
From: Julia Lawall <julia.lawall@inria.fr>
To: kbuild-all@lists.01.org
Subject: Re: [PATCH net-next v8 2/2] net: Add Qcom WWAN control driver (fwd)
Date: Sun, 04 Apr 2021 17:31:17 +0200	[thread overview]
Message-ID: <alpine.DEB.2.22.394.2104041729330.2958@hadrien> (raw)

[-- Attachment #1: Type: text/plain, Size: 4367 bytes --]

There is a clear use after free on line 213.

julia

---------- Forwarded message ----------
Date: Sat, 3 Apr 2021 04:42:45 +0800
From: kernel test robot <lkp@intel.com>
To: kbuild(a)lists.01.org
Cc: lkp(a)intel.com, Julia Lawall <julia.lawall@lip6.fr>
Subject: Re: [PATCH net-next v8 2/2] net: Add Qcom WWAN control driver

CC: kbuild-all(a)lists.01.org
In-Reply-To: <1617372397-13988-2-git-send-email-loic.poulain@linaro.org>
References: <1617372397-13988-2-git-send-email-loic.poulain@linaro.org>
TO: Loic Poulain <loic.poulain@linaro.org>
TO: gregkh(a)linuxfoundation.org
TO: kuba(a)kernel.org
TO: davem(a)davemloft.net
CC: linux-arm-msm(a)vger.kernel.org
CC: aleksander(a)aleksander.es
CC: linux-kernel(a)vger.kernel.org
CC: netdev(a)vger.kernel.org
CC: bjorn.andersson(a)linaro.org
CC: manivannan.sadhasivam(a)linaro.org
CC: Loic Poulain <loic.poulain@linaro.org>

Hi Loic,

I love your patch! Perhaps something to improve:

[auto build test WARNING on net-next/master]

url:    https://github.com/0day-ci/linux/commits/Loic-Poulain/net-Add-a-WWAN-subsystem/20210402-220002
base:   https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git bd78980be1a68d14524c51c4b4170782fada622b
:::::: branch date: 7 hours ago
:::::: commit date: 7 hours ago
config: i386-allyesconfig (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@lip6.fr>


cocci warnings: (new ones prefixed by >>)
>> drivers/net/wwan/mhi_wwan_ctrl.c:213:17-24: ERROR: reference preceded by free on line 212

vim +213 drivers/net/wwan/mhi_wwan_ctrl.c

16d753f4f524ce Loic Poulain 2021-04-02  184
16d753f4f524ce Loic Poulain 2021-04-02  185  static int mhi_wwan_ctrl_probe(struct mhi_device *mhi_dev,
16d753f4f524ce Loic Poulain 2021-04-02  186  			       const struct mhi_device_id *id)
16d753f4f524ce Loic Poulain 2021-04-02  187  {
16d753f4f524ce Loic Poulain 2021-04-02  188  	struct mhi_controller *cntrl = mhi_dev->mhi_cntrl;
16d753f4f524ce Loic Poulain 2021-04-02  189  	struct mhi_wwan_dev *mhiwwan;
16d753f4f524ce Loic Poulain 2021-04-02  190
16d753f4f524ce Loic Poulain 2021-04-02  191  	mhiwwan = kzalloc(sizeof(*mhiwwan), GFP_KERNEL);
16d753f4f524ce Loic Poulain 2021-04-02  192  	if (!mhiwwan)
16d753f4f524ce Loic Poulain 2021-04-02  193  		return -ENOMEM;
16d753f4f524ce Loic Poulain 2021-04-02  194
16d753f4f524ce Loic Poulain 2021-04-02  195  	mhiwwan->mhi_dev = mhi_dev;
16d753f4f524ce Loic Poulain 2021-04-02  196  	mhiwwan->mtu = MHI_WWAN_MAX_MTU;
16d753f4f524ce Loic Poulain 2021-04-02  197  	INIT_WORK(&mhiwwan->rx_refill, mhi_wwan_ctrl_refill_work);
16d753f4f524ce Loic Poulain 2021-04-02  198  	spin_lock_init(&mhiwwan->tx_lock);
16d753f4f524ce Loic Poulain 2021-04-02  199
16d753f4f524ce Loic Poulain 2021-04-02  200  	if (mhi_dev->dl_chan)
16d753f4f524ce Loic Poulain 2021-04-02  201  		set_bit(MHI_WWAN_DL_CAP, &mhiwwan->flags);
16d753f4f524ce Loic Poulain 2021-04-02  202  	if (mhi_dev->ul_chan)
16d753f4f524ce Loic Poulain 2021-04-02  203  		set_bit(MHI_WWAN_UL_CAP, &mhiwwan->flags);
16d753f4f524ce Loic Poulain 2021-04-02  204
16d753f4f524ce Loic Poulain 2021-04-02  205  	dev_set_drvdata(&mhi_dev->dev, mhiwwan);
16d753f4f524ce Loic Poulain 2021-04-02  206
16d753f4f524ce Loic Poulain 2021-04-02  207  	/* Register as a wwan port, id->driver_data contains wwan port type */
16d753f4f524ce Loic Poulain 2021-04-02  208  	mhiwwan->wwan_port = wwan_create_port(&cntrl->mhi_dev->dev,
16d753f4f524ce Loic Poulain 2021-04-02  209  					      id->driver_data,
16d753f4f524ce Loic Poulain 2021-04-02  210  					      &wwan_pops, mhiwwan);
16d753f4f524ce Loic Poulain 2021-04-02  211  	if (IS_ERR(mhiwwan->wwan_port)) {
16d753f4f524ce Loic Poulain 2021-04-02 @212  		kfree(mhiwwan);
16d753f4f524ce Loic Poulain 2021-04-02 @213  		return PTR_ERR(mhiwwan->wwan_port);
16d753f4f524ce Loic Poulain 2021-04-02  214  	}
16d753f4f524ce Loic Poulain 2021-04-02  215
16d753f4f524ce Loic Poulain 2021-04-02  216  	return 0;
16d753f4f524ce Loic Poulain 2021-04-02  217  };
16d753f4f524ce Loic Poulain 2021-04-02  218

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 65078 bytes --]

             reply	other threads:[~2021-04-04 15:31 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-04 15:31 Julia Lawall [this message]
2021-04-04 15:31 ` [PATCH net-next v8 2/2] net: Add Qcom WWAN control driver (fwd) Julia Lawall

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=alpine.DEB.2.22.394.2104041729330.2958@hadrien \
    --to=julia.lawall@inria.fr \
    --cc=aleksander@aleksander.es \
    --cc=bjorn.andersson@linaro.org \
    --cc=davem@davemloft.net \
    --cc=gregkh@linuxfoundation.org \
    --cc=kbuild-all@lists.01.org \
    --cc=kuba@kernel.org \
    --cc=linux-arm-msm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=loic.poulain@linaro.org \
    --cc=manivannan.sadhasivam@linaro.org \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.