| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <ef5ee5ac-5c8d-4717-aa84-7db085a556a9@suswa.mountain>
Date: Sat, 28 Jun 2025 06:04:33 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: oe-kbuild@...ts.linux.dev, Pranav Tyagi <pranav.tyagi03@...il.com>,
dave@...olabs.net, jonathan.cameron@...wei.com,
dave.jiang@...el.com, alison.schofield@...el.com,
vishal.l.verma@...el.com, ira.weiny@...el.com,
dan.j.williams@...el.com, linux-cxl@...r.kernel.org,
linux-kernel@...r.kernel.org
Cc: lkp@...el.com, oe-kbuild-all@...ts.linux.dev, ming.li@...omail.com,
rrichter@....com, peterz@...radead.org, skhan@...uxfoundation.org,
linux-kernel-mentees@...ts.linux.dev,
Pranav Tyagi <pranav.tyagi03@...il.com>
Subject: Re: [PATCH v2] cxl/memdev: automate cleanup with __free()
Hi Pranav,
kernel test robot noticed the following build warnings:
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Pranav-Tyagi/cxl-memdev-automate-cleanup-with-__free/20250623-164014
base: https://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl.git next
patch link: https://lore.kernel.org/r/20250623083841.364002-1-pranav.tyagi03%40gmail.com
patch subject: [PATCH v2] cxl/memdev: automate cleanup with __free()
config: x86_64-randconfig-161-20250627 (https://download.01.org/0day-ci/archive/20250628/202506280653.WmzTbwEN-lkp@intel.com/config)
compiler: clang version 20.1.7 (https://github.com/llvm/llvm-project 6146a88f60492b520a36f8f8f3231e15f3cc6082)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
| Closes: https://lore.kernel.org/r/202506280653.WmzTbwEN-lkp@intel.com/
smatch warnings:
drivers/cxl/core/memdev.c:881 cxl_fw_write() error: uninitialized symbol 'transfer'.
drivers/cxl/core/memdev.c:881 cxl_fw_write() error: uninitialized symbol 'transfer'.
vim +/transfer +881 drivers/cxl/core/memdev.c
9521875bbe0055 Vishal Verma 2023-06-14 874 static enum fw_upload_err cxl_fw_write(struct fw_upload *fwl, const u8 *data,
9521875bbe0055 Vishal Verma 2023-06-14 875 u32 offset, u32 size, u32 *written)
9521875bbe0055 Vishal Verma 2023-06-14 876 {
aeaefabc59ec3c Dan Williams 2023-06-25 877 struct cxl_memdev_state *mds = fwl->dd_handle;
aeaefabc59ec3c Dan Williams 2023-06-25 878 struct cxl_dev_state *cxlds = &mds->cxlds;
8d8081cecfb994 Dave Jiang 2024-09-05 879 struct cxl_mailbox *cxl_mbox = &cxlds->cxl_mbox;
9521875bbe0055 Vishal Verma 2023-06-14 880 struct cxl_memdev *cxlmd = cxlds->cxlmd;
f76a702ca63e85 Pranav Tyagi 2025-06-23 @881 struct cxl_mbox_transfer_fw *transfer __free(kfree);
cleanup magic variables need to be initialized to NULL etc.
9521875bbe0055 Vishal Verma 2023-06-14 882 struct cxl_mbox_cmd mbox_cmd;
9521875bbe0055 Vishal Verma 2023-06-14 883 u32 cur_size, remaining;
9521875bbe0055 Vishal Verma 2023-06-14 884 size_t size_in;
9521875bbe0055 Vishal Verma 2023-06-14 885 int rc;
9521875bbe0055 Vishal Verma 2023-06-14 886
9521875bbe0055 Vishal Verma 2023-06-14 887 *written = 0;
9521875bbe0055 Vishal Verma 2023-06-14 888
9521875bbe0055 Vishal Verma 2023-06-14 889 /* Offset has to be aligned to 128B (CXL-3.0 8.2.9.3.2 Table 8-57) */
9521875bbe0055 Vishal Verma 2023-06-14 890 if (!IS_ALIGNED(offset, CXL_FW_TRANSFER_ALIGNMENT)) {
9521875bbe0055 Vishal Verma 2023-06-14 891 dev_err(&cxlmd->dev,
9521875bbe0055 Vishal Verma 2023-06-14 892 "misaligned offset for FW transfer slice (%u)\n",
9521875bbe0055 Vishal Verma 2023-06-14 893 offset);
9521875bbe0055 Vishal Verma 2023-06-14 894 return FW_UPLOAD_ERR_RW_ERROR;
This return will try to free an uninitialized pointer.
9521875bbe0055 Vishal Verma 2023-06-14 895 }
9521875bbe0055 Vishal Verma 2023-06-14 896
9521875bbe0055 Vishal Verma 2023-06-14 897 /*
aeaefabc59ec3c Dan Williams 2023-06-25 898 * Pick transfer size based on mds->payload_size @size must bw 128-byte
aeaefabc59ec3c Dan Williams 2023-06-25 899 * aligned, ->payload_size is a power of 2 starting at 256 bytes, and
aeaefabc59ec3c Dan Williams 2023-06-25 900 * sizeof(*transfer) is 128. These constraints imply that @cur_size
aeaefabc59ec3c Dan Williams 2023-06-25 901 * will always be 128b aligned.
9521875bbe0055 Vishal Verma 2023-06-14 902 */
8d8081cecfb994 Dave Jiang 2024-09-05 903 cur_size = min_t(size_t, size, cxl_mbox->payload_size - sizeof(*transfer));
9521875bbe0055 Vishal Verma 2023-06-14 904
9521875bbe0055 Vishal Verma 2023-06-14 905 remaining = size - cur_size;
9521875bbe0055 Vishal Verma 2023-06-14 906 size_in = struct_size(transfer, data, cur_size);
9521875bbe0055 Vishal Verma 2023-06-14 907
aeaefabc59ec3c Dan Williams 2023-06-25 908 if (test_and_clear_bit(CXL_FW_CANCEL, mds->fw.state))
9521875bbe0055 Vishal Verma 2023-06-14 909 return cxl_fw_do_cancel(fwl);
9521875bbe0055 Vishal Verma 2023-06-14 910
9521875bbe0055 Vishal Verma 2023-06-14 911 /*
9521875bbe0055 Vishal Verma 2023-06-14 912 * Slot numbers are 1-indexed
9521875bbe0055 Vishal Verma 2023-06-14 913 * cur_slot is the 0-indexed next_slot (i.e. 'cur_slot - 1 + 1')
9521875bbe0055 Vishal Verma 2023-06-14 914 * Check for rollover using modulo, and 1-index it by adding 1
9521875bbe0055 Vishal Verma 2023-06-14 915 */
aeaefabc59ec3c Dan Williams 2023-06-25 916 mds->fw.next_slot = (mds->fw.cur_slot % mds->fw.num_slots) + 1;
9521875bbe0055 Vishal Verma 2023-06-14 917
9521875bbe0055 Vishal Verma 2023-06-14 918 /* Do the transfer via mailbox cmd */
9521875bbe0055 Vishal Verma 2023-06-14 919 transfer = kzalloc(size_in, GFP_KERNEL);
9521875bbe0055 Vishal Verma 2023-06-14 920 if (!transfer)
9521875bbe0055 Vishal Verma 2023-06-14 921 return FW_UPLOAD_ERR_RW_ERROR;
9521875bbe0055 Vishal Verma 2023-06-14 922
9521875bbe0055 Vishal Verma 2023-06-14 923 transfer->offset = cpu_to_le32(offset / CXL_FW_TRANSFER_ALIGNMENT);
9521875bbe0055 Vishal Verma 2023-06-14 924 memcpy(transfer->data, data + offset, cur_size);
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists