From: Dan Carpenter <dan.carpenter@linaro.org>
To: oe-kbuild@lists.linux.dev, Geetha sowjanya <gakula@marvell.com>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev, kuba@kernel.org,
davem@davemloft.net, pabeni@redhat.com, edumazet@google.com,
sgoutham@marvell.com, gakula@marvell.com, sbhatta@marvell.com,
hkelam@marvell.com
Subject: Re: [net-next PATCH 3/9] octeontx2-pf: Create representor netdev
Date: Wed, 17 Apr 2024 18:24:13 +0300 [thread overview]
Message-ID: <a55c4d98-030c-420e-b29d-3836e1ce0876@moroto.mountain> (raw)
In-Reply-To: <20240416050616.6056-4-gakula@marvell.com>
Hi Geetha,
kernel test robot noticed the following build warnings:
url: https://github.com/intel-lab-lkp/linux/commits/Geetha-sowjanya/octeontx2-pf-Refactoring-RVU-driver/20240416-131052
base: net-next/main
patch link: https://lore.kernel.org/r/20240416050616.6056-4-gakula%40marvell.com
patch subject: [net-next PATCH 3/9] octeontx2-pf: Create representor netdev
config: alpha-randconfig-r081-20240417 (https://download.01.org/0day-ci/archive/20240417/202404172208.4REfSKKS-lkp@intel.com/config)
compiler: alpha-linux-gcc (GCC) 13.2.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202404172208.4REfSKKS-lkp@intel.com/
New smatch warnings:
drivers/net/ethernet/marvell/octeontx2/nic/rep.c:170 rvu_rep_create() error: dereferencing freed memory 'ndev'
vim +/ndev +170 drivers/net/ethernet/marvell/octeontx2/nic/rep.c
f9a5b510759eeb Geetha sowjanya 2024-04-16 131
f9a5b510759eeb Geetha sowjanya 2024-04-16 132 int rvu_rep_create(struct otx2_nic *priv)
f9a5b510759eeb Geetha sowjanya 2024-04-16 133 {
f9a5b510759eeb Geetha sowjanya 2024-04-16 134 int rep_cnt = priv->rep_cnt;
f9a5b510759eeb Geetha sowjanya 2024-04-16 135 struct net_device *ndev;
f9a5b510759eeb Geetha sowjanya 2024-04-16 136 struct rep_dev *rep;
f9a5b510759eeb Geetha sowjanya 2024-04-16 137 int rep_id, err;
f9a5b510759eeb Geetha sowjanya 2024-04-16 138 u16 pcifunc;
f9a5b510759eeb Geetha sowjanya 2024-04-16 139
f9a5b510759eeb Geetha sowjanya 2024-04-16 140 priv->reps = devm_kcalloc(priv->dev, rep_cnt, sizeof(struct rep_dev), GFP_KERNEL);
f9a5b510759eeb Geetha sowjanya 2024-04-16 141 if (!priv->reps)
f9a5b510759eeb Geetha sowjanya 2024-04-16 142 return -ENOMEM;
f9a5b510759eeb Geetha sowjanya 2024-04-16 143
f9a5b510759eeb Geetha sowjanya 2024-04-16 144 for (rep_id = 0; rep_id < rep_cnt; rep_id++) {
f9a5b510759eeb Geetha sowjanya 2024-04-16 145 ndev = alloc_etherdev(sizeof(*rep));
f9a5b510759eeb Geetha sowjanya 2024-04-16 146 if (!ndev) {
f9a5b510759eeb Geetha sowjanya 2024-04-16 147 dev_err(priv->dev, "PFVF representor:%d creation failed\n", rep_id);
f9a5b510759eeb Geetha sowjanya 2024-04-16 148 err = -ENOMEM;
f9a5b510759eeb Geetha sowjanya 2024-04-16 149 goto exit;
f9a5b510759eeb Geetha sowjanya 2024-04-16 150 }
f9a5b510759eeb Geetha sowjanya 2024-04-16 151
f9a5b510759eeb Geetha sowjanya 2024-04-16 152 rep = netdev_priv(ndev);
f9a5b510759eeb Geetha sowjanya 2024-04-16 153 priv->reps[rep_id] = rep;
f9a5b510759eeb Geetha sowjanya 2024-04-16 154 rep->mdev = priv;
f9a5b510759eeb Geetha sowjanya 2024-04-16 155 rep->netdev = ndev;
f9a5b510759eeb Geetha sowjanya 2024-04-16 156 rep->rep_id = rep_id;
f9a5b510759eeb Geetha sowjanya 2024-04-16 157
f9a5b510759eeb Geetha sowjanya 2024-04-16 158 ndev->min_mtu = OTX2_MIN_MTU;
f9a5b510759eeb Geetha sowjanya 2024-04-16 159 ndev->max_mtu = priv->hw.max_mtu;
f9a5b510759eeb Geetha sowjanya 2024-04-16 160 pcifunc = priv->rep_pf_map[rep_id];
f9a5b510759eeb Geetha sowjanya 2024-04-16 161 rep->pcifunc = pcifunc;
f9a5b510759eeb Geetha sowjanya 2024-04-16 162
f9a5b510759eeb Geetha sowjanya 2024-04-16 163 snprintf(ndev->name, sizeof(ndev->name), "r%dp%dv%d", rep_id,
f9a5b510759eeb Geetha sowjanya 2024-04-16 164 rvu_get_pf(pcifunc), (pcifunc & RVU_PFVF_FUNC_MASK));
f9a5b510759eeb Geetha sowjanya 2024-04-16 165
f9a5b510759eeb Geetha sowjanya 2024-04-16 166 eth_hw_addr_random(ndev);
f9a5b510759eeb Geetha sowjanya 2024-04-16 167 if (register_netdev(ndev)) {
err = register_netdev(ndev);
if (err) {
f9a5b510759eeb Geetha sowjanya 2024-04-16 168 dev_err(priv->dev, "PFVF reprentator registration failed\n");
f9a5b510759eeb Geetha sowjanya 2024-04-16 169 free_netdev(ndev);
^^^^
freed
f9a5b510759eeb Geetha sowjanya 2024-04-16 @170 ndev->netdev_ops = NULL;
^^^^^^^^^^^^^^^^^^^^^^^
Use after free
f9a5b510759eeb Geetha sowjanya 2024-04-16 171 goto exit;
f9a5b510759eeb Geetha sowjanya 2024-04-16 172 }
f9a5b510759eeb Geetha sowjanya 2024-04-16 173 }
f9a5b510759eeb Geetha sowjanya 2024-04-16 174 err = rvu_rep_napi_init(priv);
f9a5b510759eeb Geetha sowjanya 2024-04-16 175 if (err)
f9a5b510759eeb Geetha sowjanya 2024-04-16 176 goto exit;
f9a5b510759eeb Geetha sowjanya 2024-04-16 177
f9a5b510759eeb Geetha sowjanya 2024-04-16 178 return 0;
f9a5b510759eeb Geetha sowjanya 2024-04-16 179 exit:
f9a5b510759eeb Geetha sowjanya 2024-04-16 180 rvu_rep_free_netdev(priv);
rvu_rep_free_netdev() also calls free_netdev() so it's a double free. I
would normally write this as:
exit:
while (--rep_id >= 0) {
unregister_netdev(priv->reps[rep_id]);
free_netdev(priv->reps[rep_id]);
}
return err;
When you write it that way then rvu_rep_free_netdev() can be made easier
as well:
static void rvu_rep_free_netdev(struct otx2_nic *priv)
{
int rep_id;
for (rep_id = 0; rep_id < priv->rep_cnt; rep_id++) {
unregister_netdev(priv->reps[rep_id]);
free_netdev(priv->reps[rep_id]);
}
}
There should be no need to call devm_kfree(priv->dev, priv->reps);.
f9a5b510759eeb Geetha sowjanya 2024-04-16 @181 return err;
f9a5b510759eeb Geetha sowjanya 2024-04-16 182 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next prev parent reply other threads:[~2024-04-17 15:24 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-16 5:06 [net-next PATCH 0/9] Introduce RVU representors Geetha sowjanya
2024-04-16 5:06 ` [net-next PATCH 1/9] octeontx2-pf: Refactoring RVU driver Geetha sowjanya
2024-04-16 5:06 ` [net-next PATCH 2/9] octeontx2-pf: RVU representor driver Geetha sowjanya
2024-04-16 16:17 ` Kalesh Anakkur Purayil
2024-04-17 13:37 ` Dan Carpenter
2024-04-17 13:45 ` [EXTERNAL] " Geethasowjanya Akula
2024-04-17 16:22 ` kernel test robot
2024-04-16 5:06 ` [net-next PATCH 3/9] octeontx2-pf: Create representor netdev Geetha sowjanya
2024-04-17 0:31 ` kernel test robot
2024-04-17 1:24 ` kernel test robot
2024-04-17 4:28 ` Kalesh Anakkur Purayil
2024-04-17 13:43 ` [EXTERNAL] " Geethasowjanya Akula
2024-04-17 15:24 ` Dan Carpenter [this message]
2024-04-17 15:36 ` Dan Carpenter
2024-04-16 5:06 ` [net-next PATCH 4/9] octeontx2-pf: Add basic net_device_ops Geetha sowjanya
2024-04-16 5:06 ` [net-next PATCH 5/9] octeontx2-af: Add packet path between representor and VF Geetha sowjanya
2024-04-17 4:10 ` Kalesh Anakkur Purayil
2024-04-17 4:15 ` Kalesh Anakkur Purayil
2024-04-17 13:48 ` [EXTERNAL] " Geethasowjanya Akula
2024-04-17 18:08 ` Dan Carpenter
2024-04-16 5:06 ` [net-next PATCH 6/9] octeontx2-pf: Get VF stats via representor Geetha sowjanya
2024-04-16 5:06 ` [net-next PATCH 7/9] octeontx2-pf: Add support to sync link state between representor and VFs Geetha sowjanya
2024-04-16 5:06 ` [net-next PATCH 8/9] octeontx2-pf: Configure VF mtu via representor Geetha sowjanya
2024-04-16 5:06 ` [net-next PATCH 9/9] octeontx2-pf: Add representors for sdp MAC Geetha sowjanya
-- strict thread matches above, loose matches on Subject: below --
2024-04-17 14:37 [net-next PATCH 3/9] octeontx2-pf: Create representor netdev kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a55c4d98-030c-420e-b29d-3836e1ce0876@moroto.mountain \
--to=dan.carpenter@linaro.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=gakula@marvell.com \
--cc=hkelam@marvell.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@intel.com \
--cc=netdev@vger.kernel.org \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=oe-kbuild@lists.linux.dev \
--cc=pabeni@redhat.com \
--cc=sbhatta@marvell.com \
--cc=sgoutham@marvell.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.