| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202409180041.GEhgD6dC-lkp@intel.com>
Date: Wed, 18 Sep 2024 00:55:16 +0800
From: kernel test robot <lkp@...el.com>
To: Mikhail Arkhipov <m.arhipov@...a.ru>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: llvm@...ts.linux.dev, oe-kbuild-all@...ts.linux.dev,
Mikhail Arkhipov <m.arhipov@...a.ru>,
Uwe Kleine-König <u.kleine-koenig@...gutronix.de>,
Felipe Balbi <balbi@...com>, Ben Dooks <ben.dooks@...ethink.co.uk>,
Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
lvc-project@...uxtesting.org
Subject: Re: [PATCH] usb: gadget: r8a66597-udc: Fix double free in
r8a66597_probe
Hi Mikhail,
kernel test robot noticed the following build warnings:
[auto build test WARNING on usb/usb-testing]
[also build test WARNING on usb/usb-next usb/usb-linus linus/master v6.11 next-20240917]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Mikhail-Arkhipov/usb-gadget-r8a66597-udc-Fix-double-free-in-r8a66597_probe/20240917-063133
base: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
patch link: https://lore.kernel.org/r/20240916222937.12878-1-m.arhipov%40rosa.ru
patch subject: [PATCH] usb: gadget: r8a66597-udc: Fix double free in r8a66597_probe
config: i386-buildonly-randconfig-001-20240917 (https://download.01.org/0day-ci/archive/20240918/202409180041.GEhgD6dC-lkp@intel.com/config)
compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240918/202409180041.GEhgD6dC-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202409180041.GEhgD6dC-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> drivers/usb/gadget/udc/r8a66597-udc.c:1962:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
1962 | r8a66597->ep0_req = NULL;
| ^
drivers/usb/gadget/udc/r8a66597-udc.c:1960:2: note: previous statement is here
1960 | if (r8a66597->ep0_req)
| ^
1 warning generated.
vim +/if +1962 drivers/usb/gadget/udc/r8a66597-udc.c
1832
1833 static int r8a66597_probe(struct platform_device *pdev)
1834 {
1835 struct device *dev = &pdev->dev;
1836 char clk_name[8];
1837 struct resource *ires;
1838 int irq;
1839 void __iomem *reg = NULL;
1840 struct r8a66597 *r8a66597 = NULL;
1841 int ret = 0;
1842 int i;
1843 unsigned long irq_trigger;
1844
1845 reg = devm_platform_ioremap_resource(pdev, 0);
1846 if (IS_ERR(reg))
1847 return PTR_ERR(reg);
1848
1849 ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
1850 if (!ires)
1851 return -EINVAL;
1852 irq = ires->start;
1853 irq_trigger = ires->flags & IRQF_TRIGGER_MASK;
1854
1855 if (irq < 0) {
1856 dev_err(dev, "platform_get_irq error.\n");
1857 return -ENODEV;
1858 }
1859
1860 /* initialize ucd */
1861 r8a66597 = devm_kzalloc(dev, sizeof(struct r8a66597), GFP_KERNEL);
1862 if (r8a66597 == NULL)
1863 return -ENOMEM;
1864
1865 spin_lock_init(&r8a66597->lock);
1866 platform_set_drvdata(pdev, r8a66597);
1867 r8a66597->pdata = dev_get_platdata(dev);
1868 r8a66597->irq_sense_low = irq_trigger == IRQF_TRIGGER_LOW;
1869
1870 r8a66597->gadget.ops = &r8a66597_gadget_ops;
1871 r8a66597->gadget.max_speed = USB_SPEED_HIGH;
1872 r8a66597->gadget.name = udc_name;
1873
1874 timer_setup(&r8a66597->timer, r8a66597_timer, 0);
1875 r8a66597->reg = reg;
1876
1877 if (r8a66597->pdata->on_chip) {
1878 snprintf(clk_name, sizeof(clk_name), "usb%d", pdev->id);
1879 r8a66597->clk = devm_clk_get(dev, clk_name);
1880 if (IS_ERR(r8a66597->clk)) {
1881 dev_err(dev, "cannot get clock \"%s\"\n", clk_name);
1882 return PTR_ERR(r8a66597->clk);
1883 }
1884 clk_prepare_enable(r8a66597->clk);
1885 }
1886
1887 if (r8a66597->pdata->sudmac) {
1888 ret = r8a66597_sudmac_ioremap(r8a66597, pdev);
1889 if (ret < 0)
1890 goto clean_up2;
1891 }
1892
1893 disable_controller(r8a66597); /* make sure controller is disabled */
1894
1895 ret = devm_request_irq(dev, irq, r8a66597_irq, IRQF_SHARED,
1896 udc_name, r8a66597);
1897 if (ret < 0) {
1898 dev_err(dev, "request_irq error (%d)\n", ret);
1899 goto clean_up2;
1900 }
1901
1902 INIT_LIST_HEAD(&r8a66597->gadget.ep_list);
1903 r8a66597->gadget.ep0 = &r8a66597->ep[0].ep;
1904 INIT_LIST_HEAD(&r8a66597->gadget.ep0->ep_list);
1905 for (i = 0; i < R8A66597_MAX_NUM_PIPE; i++) {
1906 struct r8a66597_ep *ep = &r8a66597->ep[i];
1907
1908 if (i != 0) {
1909 INIT_LIST_HEAD(&r8a66597->ep[i].ep.ep_list);
1910 list_add_tail(&r8a66597->ep[i].ep.ep_list,
1911 &r8a66597->gadget.ep_list);
1912 }
1913 ep->r8a66597 = r8a66597;
1914 INIT_LIST_HEAD(&ep->queue);
1915 ep->ep.name = r8a66597_ep_name[i];
1916 ep->ep.ops = &r8a66597_ep_ops;
1917 usb_ep_set_maxpacket_limit(&ep->ep, 512);
1918
1919 if (i == 0) {
1920 ep->ep.caps.type_control = true;
1921 } else {
1922 ep->ep.caps.type_iso = true;
1923 ep->ep.caps.type_bulk = true;
1924 ep->ep.caps.type_int = true;
1925 }
1926 ep->ep.caps.dir_in = true;
1927 ep->ep.caps.dir_out = true;
1928 }
1929 usb_ep_set_maxpacket_limit(&r8a66597->ep[0].ep, 64);
1930 r8a66597->ep[0].pipenum = 0;
1931 r8a66597->ep[0].fifoaddr = CFIFO;
1932 r8a66597->ep[0].fifosel = CFIFOSEL;
1933 r8a66597->ep[0].fifoctr = CFIFOCTR;
1934 r8a66597->ep[0].pipectr = get_pipectr_addr(0);
1935 r8a66597->pipenum2ep[0] = &r8a66597->ep[0];
1936 r8a66597->epaddr2ep[0] = &r8a66597->ep[0];
1937
1938 r8a66597->ep0_req = r8a66597_alloc_request(&r8a66597->ep[0].ep,
1939 GFP_KERNEL);
1940 if (r8a66597->ep0_req == NULL) {
1941 ret = -ENOMEM;
1942 goto clean_up2;
1943 }
1944 r8a66597->ep0_req->complete = nop_completion;
1945
1946 ret = usb_add_gadget_udc(dev, &r8a66597->gadget);
1947 if (ret)
1948 goto err_add_udc;
1949
1950 dev_info(dev, "version %s\n", DRIVER_VERSION);
1951 return 0;
1952
1953 err_add_udc:
1954 r8a66597_free_request(&r8a66597->ep[0].ep, r8a66597->ep0_req);
1955 r8a66597->ep0_req = NULL;
1956 clean_up2:
1957 if (r8a66597->pdata->on_chip)
1958 clk_disable_unprepare(r8a66597->clk);
1959
1960 if (r8a66597->ep0_req)
1961 r8a66597_free_request(&r8a66597->ep[0].ep, r8a66597->ep0_req);
> 1962 r8a66597->ep0_req = NULL;
1963
1964 return ret;
1965 }
1966
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists