From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757450AbbBEMCD (ORCPT ); Thu, 5 Feb 2015 07:02:03 -0500 Received: from userp1040.oracle.com ([156.151.31.81]:31724 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757096AbbBEMCA (ORCPT ); Thu, 5 Feb 2015 07:02:00 -0500 Date: Thu, 5 Feb 2015 15:01:38 +0300 From: Dan Carpenter To: Wingman Kwok Cc: SF Markus Elfring , Murali Karicheri , Wingman Kwok , netdev@vger.kernel.org, LKML , kernel-janitors@vger.kernel.org, Julia Lawall Subject: Re: [PATCH] NetCP: Deletion of unnecessary checks before two function calls Message-ID: <20150205120138.GD5336@mwanda> References: <530C5E18.1020800@users.sourceforge.net> <530CD2C4.4050903@users.sourceforge.net> <530CF8FF.8080600@users.sourceforge.net> <530DD06F.4090703@users.sourceforge.net> <5317A59D.4@users.sourceforge.net> <54D11FEF.10804@users.sourceforge.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <54D11FEF.10804@users.sourceforge.net> User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: acsinet22.oracle.com [141.146.126.238] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Wingman, There are some bugs in this error handling. On Tue, Feb 03, 2015 at 08:22:23PM +0100, SF Markus Elfring wrote: > diff --git a/drivers/net/ethernet/ti/netcp_ethss.c b/drivers/net/ethernet/ti/netcp_ethss.c > index fa1041a..cbd6dde 100644 > --- a/drivers/net/ethernet/ti/netcp_ethss.c > +++ b/drivers/net/ethernet/ti/netcp_ethss.c > @@ -2010,12 +2010,10 @@ static int gbe_probe(struct netcp_device *netcp_device, struct device *dev, > quit: > if (gbe_dev->hw_stats) > devm_kfree(dev, gbe_dev->hw_stats); > - if (gbe_dev->ale) > - cpsw_ale_destroy(gbe_dev->ale); > + cpsw_ale_destroy(gbe_dev->ale); > if (gbe_dev->ss_regs) > devm_iounmap(dev, gbe_dev->ss_regs); > - if (interfaces) > - of_node_put(interfaces); > + of_node_put(interfaces); ^^^^^^^^^^ "interfaces" is sometimes unintialized in this code. I don't know why GCC doesn't catch this... :( This is a "one rrr bug", which is caused because you just have one error label "quit" which handles all the error handling. Please read my Google+ comment on error handling. https://plus.google.com/106378716002406849458/posts/dnanfhQ4mHQ > devm_kfree(dev, gbe_dev); ^^^^^^^^^^^^^^^^^^^^^^^^ This is not the right way to use the devm_ interface. These things are freed automatically on error or when we are done with them. This driver is double freeing pretty much everything. Grep for devm_kfree() and fix everything. I don't know why kbuild didn't catch this... regards dan carpenter