linux-kernel - Re: [PATCH net-next v8 2/2] net: Add Qcom WWAN control driver (fwd)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Sun, 4 Apr 2021 17:31:17 +0200 (CEST)
From:   Julia Lawall <julia.lawall@...ia.fr>
To:     Loic Poulain <loic.poulain@...aro.org>, gregkh@...uxfoundation.org,
        kuba@...nel.org, davem@...emloft.net
cc:     aleksander@...ksander.es, linux-arm-msm@...r.kernel.org,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        bjorn.andersson@...aro.org, manivannan.sadhasivam@...aro.org,
        kbuild-all@...ts.01.org
Subject: Re: [PATCH net-next v8 2/2] net: Add Qcom WWAN control driver
 (fwd)

There is a clear use after free on line 213.

julia

---------- Forwarded message ----------
Date: Sat, 3 Apr 2021 04:42:45 +0800
From: kernel test robot <lkp@...el.com>
To: kbuild@...ts.01.org
Cc: lkp@...el.com, Julia Lawall <julia.lawall@...6.fr>
Subject: Re: [PATCH net-next v8 2/2] net: Add Qcom WWAN control driver

CC: kbuild-all@...ts.01.org
In-Reply-To: <1617372397-13988-2-git-send-email-loic.poulain@...aro.org>
References: <1617372397-13988-2-git-send-email-loic.poulain@...aro.org>
TO: Loic Poulain <loic.poulain@...aro.org>
TO: gregkh@...uxfoundation.org
TO: kuba@...nel.org
TO: davem@...emloft.net
CC: linux-arm-msm@...r.kernel.org
CC: aleksander@...ksander.es
CC: linux-kernel@...r.kernel.org
CC: netdev@...r.kernel.org
CC: bjorn.andersson@...aro.org
CC: manivannan.sadhasivam@...aro.org
CC: Loic Poulain <loic.poulain@...aro.org>

Hi Loic,

I love your patch! Perhaps something to improve:

[auto build test WARNING on net-next/master]

url:    https://github.com/0day-ci/linux/commits/Loic-Poulain/net-Add-a-WWAN-subsystem/20210402-220002
base:   https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git bd78980be1a68d14524c51c4b4170782fada622b
:::::: branch date: 7 hours ago
:::::: commit date: 7 hours ago
config: i386-allyesconfig (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Julia Lawall <julia.lawall@...6.fr>


cocci warnings: (new ones prefixed by >>)
>> drivers/net/wwan/mhi_wwan_ctrl.c:213:17-24: ERROR: reference preceded by free on line 212

vim +213 drivers/net/wwan/mhi_wwan_ctrl.c

16d753f4f524ce Loic Poulain 2021-04-02  184
16d753f4f524ce Loic Poulain 2021-04-02  185  static int mhi_wwan_ctrl_probe(struct mhi_device *mhi_dev,
16d753f4f524ce Loic Poulain 2021-04-02  186  			       const struct mhi_device_id *id)
16d753f4f524ce Loic Poulain 2021-04-02  187  {
16d753f4f524ce Loic Poulain 2021-04-02  188  	struct mhi_controller *cntrl = mhi_dev->mhi_cntrl;
16d753f4f524ce Loic Poulain 2021-04-02  189  	struct mhi_wwan_dev *mhiwwan;
16d753f4f524ce Loic Poulain 2021-04-02  190
16d753f4f524ce Loic Poulain 2021-04-02  191  	mhiwwan = kzalloc(sizeof(*mhiwwan), GFP_KERNEL);
16d753f4f524ce Loic Poulain 2021-04-02  192  	if (!mhiwwan)
16d753f4f524ce Loic Poulain 2021-04-02  193  		return -ENOMEM;
16d753f4f524ce Loic Poulain 2021-04-02  194
16d753f4f524ce Loic Poulain 2021-04-02  195  	mhiwwan->mhi_dev = mhi_dev;
16d753f4f524ce Loic Poulain 2021-04-02  196  	mhiwwan->mtu = MHI_WWAN_MAX_MTU;
16d753f4f524ce Loic Poulain 2021-04-02  197  	INIT_WORK(&mhiwwan->rx_refill, mhi_wwan_ctrl_refill_work);
16d753f4f524ce Loic Poulain 2021-04-02  198  	spin_lock_init(&mhiwwan->tx_lock);
16d753f4f524ce Loic Poulain 2021-04-02  199
16d753f4f524ce Loic Poulain 2021-04-02  200  	if (mhi_dev->dl_chan)
16d753f4f524ce Loic Poulain 2021-04-02  201  		set_bit(MHI_WWAN_DL_CAP, &mhiwwan->flags);
16d753f4f524ce Loic Poulain 2021-04-02  202  	if (mhi_dev->ul_chan)
16d753f4f524ce Loic Poulain 2021-04-02  203  		set_bit(MHI_WWAN_UL_CAP, &mhiwwan->flags);
16d753f4f524ce Loic Poulain 2021-04-02  204
16d753f4f524ce Loic Poulain 2021-04-02  205  	dev_set_drvdata(&mhi_dev->dev, mhiwwan);
16d753f4f524ce Loic Poulain 2021-04-02  206
16d753f4f524ce Loic Poulain 2021-04-02  207  	/* Register as a wwan port, id->driver_data contains wwan port type */
16d753f4f524ce Loic Poulain 2021-04-02  208  	mhiwwan->wwan_port = wwan_create_port(&cntrl->mhi_dev->dev,
16d753f4f524ce Loic Poulain 2021-04-02  209  					      id->driver_data,
16d753f4f524ce Loic Poulain 2021-04-02  210  					      &wwan_pops, mhiwwan);
16d753f4f524ce Loic Poulain 2021-04-02  211  	if (IS_ERR(mhiwwan->wwan_port)) {
16d753f4f524ce Loic Poulain 2021-04-02 @212  		kfree(mhiwwan);
16d753f4f524ce Loic Poulain 2021-04-02 @213  		return PTR_ERR(mhiwwan->wwan_port);
16d753f4f524ce Loic Poulain 2021-04-02  214  	}
16d753f4f524ce Loic Poulain 2021-04-02  215
16d753f4f524ce Loic Poulain 2021-04-02  216  	return 0;
16d753f4f524ce Loic Poulain 2021-04-02  217  };
16d753f4f524ce Loic Poulain 2021-04-02  218

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
Download attachment ".config.gz" of type "application/gzip" (65078 bytes)