[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <8f87bfca-ab5f-4b32-a400-a90d09b64cf1@suswa.mountain>
Date: Wed, 29 Nov 2023 16:21:31 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: James Tai <james.tai@...ltek.com>
Cc: Thomas Gleixner <tglx@...utronix.de>,
Marc Zyngier <maz@...nel.org>,
Rob Herring <robh+dt@...nel.org>,
Krzysztof Kozlowski <krzysztof.kozlowski+dt@...aro.org>,
Conor Dooley <conor+dt@...nel.org>,
linux-kernel@...r.kernel.org, devicetree@...r.kernel.org,
kernel test robot <lkp@...el.com>,
Dan Carpenter <error27@...il.com>
Subject: Re: [PATCH v3 2/6] irqchip: Add interrupt controller support for
Realtek DHC SoCs
On Wed, Nov 29, 2023 at 11:21:06AM +0300, Dan Carpenter wrote:
> > +int realtek_intc_probe(struct platform_device *pdev, const struct realtek_intc_info *info)
> > +{
> > + struct realtek_intc_data *data;
> > + struct device *dev = &pdev->dev;
> > + struct device_node *node = dev->of_node;
> > + int ret, i;
> > +
> > + data = devm_kzalloc(dev, struct_size(data, subset_data, info->cfg_num), GFP_KERNEL);
> > + if (!data)
> > + return -ENOMEM;
> > +
> > + data->base = of_iomap(node, 0);
> > + if (!data->base) {
> > + ret = -ENOMEM;
> > + goto out_cleanup;
>
> devm_ allocations are cleaned up automatically so there is no need to
> call devm_kfree() before returning.
>
> regards,
> dan carpenter
>
> > + }
> > +
> > + data->info = info;
> > +
> > + raw_spin_lock_init(&data->lock);
> > +
> > + data->domain = irq_domain_add_linear(node, 32, &realtek_intc_domain_ops, data);
Btw, as I was testing the other static checker warning for <= 0, my
static checker really wants this irq_domain_add_linear() to be cleaned
up on the error path.
Otherwise it probably leads to a use after free because we free data
(automatically or manually) but it's still on a list somewhere.
> > + if (!data->domain) {
> > + ret = -ENOMEM;
> > + goto out_cleanup;
> > + }
> > +
> > + data->subset_data_num = info->cfg_num;
> > + for (i = 0; i < info->cfg_num; i++) {
> > + ret = realtek_intc_subset(node, data, i);
> > + if (ret) {
> > + WARN(ret, "failed to init subset %d: %d", i, ret);
> > + ret = -ENOMEM;
> > + goto out_cleanup;
This error path.
regards,
dan carpenter
> > + }
> > + }
> > +
> > + platform_set_drvdata(pdev, data);
> > +
> > + return 0;
> > +
> > +out_cleanup:
> > +
> > + if (data->base)
> > + iounmap(data->base);
> > +
> > + devm_kfree(dev, data);
> > +
> > + return ret;
> > +}
Powered by blists - more mailing lists