Hi Julia,
There seems to be a potential use after free on line 631.
Yes. This problem has been already recognized and is now under
discussion.
Big thanks for "catching" it :-)
Best regards,
Łukasz Majewski
julia
---------- Forwarded message ----------
Date: Sat, 28 Sep 2019 01:40:25 +0800
From: kbuild test robot <lkp(a)intel.com>
To: kbuild(a)01.org
Cc: Julia Lawall <julia.lawall(a)lip6.fr>
Subject: [linux-next:pending-fixes 12639/12689]
drivers/spi/spidev.c:631:17-23: ERROR: reference preceded by free on
line 628
CC: kbuild-all(a)01.org
TO: Lukasz Majewski <lukma(a)denx.de>
CC: Mark Brown <broonie(a)kernel.org>
tree:
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
pending-fixes head: d20eeb14322b02c728ce7fe77d41be77a3a37494
commit: 9f918a728cf86b2757b6a7025e1f46824bfe3155 [12639/12689] spi:
Add call to spi_slave_abort() function when spidev driver is released
:::::: branch date: 26 hours ago :::::: commit date: 2 days ago
If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp(a)intel.com>
Reported-by: Julia Lawall <julia.lawall(a)lip6.fr>
>> drivers/spi/spidev.c:631:17-23: ERROR: reference preceded by free
>> on line 628
#
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commi...
git remote add linux-next
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
git remote update linux-next git checkout
9f918a728cf86b2757b6a7025e1f46824bfe3155 vim +631 drivers/spi/spidev.c
814a8d50eb1d88 Andrea Paterniani 2007-05-08 599
814a8d50eb1d88 Andrea Paterniani 2007-05-08 600 static int
spidev_release(struct inode *inode, struct file *filp) 814a8d50eb1d88
Andrea Paterniani 2007-05-08 601 { 814a8d50eb1d88 Andrea Paterniani
2007-05-08 602 struct spidev_data *spidev;
814a8d50eb1d88 Andrea Paterniani 2007-05-08 603 814a8d50eb1d88
Andrea Paterniani 2007-05-08 604
mutex_lock(&device_list_lock); 814a8d50eb1d88 Andrea Paterniani
2007-05-08 605 spidev = filp->private_data; 814a8d50eb1d88
Andrea Paterniani 2007-05-08 606 filp->private_data = NULL;
b2c8daddcbe03a David Brownell 2008-06-05 607 b2c8daddcbe03a David
Brownell 2008-06-05 608 /* last close? */ 814a8d50eb1d88
Andrea Paterniani 2007-05-08 609 spidev->users--;
814a8d50eb1d88 Andrea Paterniani 2007-05-08 610 if
(!spidev->users) { b2c8daddcbe03a David Brownell 2008-06-05 611
int dofree; b2c8daddcbe03a David
Brownell 2008-06-05 612 865f6d1974ddd9 Ray Jui
2014-10-09 613 kfree(spidev->tx_buffer);
865f6d1974ddd9 Ray Jui 2014-10-09 614
spidev->tx_buffer = NULL; 865f6d1974ddd9 Ray Jui 2014-10-09
615 865f6d1974ddd9 Ray Jui 2014-10-09 616
kfree(spidev->rx_buffer); 865f6d1974ddd9 Ray Jui
2014-10-09 617 spidev->rx_buffer = NULL;
b2c8daddcbe03a David Brownell 2008-06-05 618 56ea1075e7f077 Mark
Brown 2015-11-16 619
spin_lock_irq(&spidev->spi_lock); dd85ebf681ef0e Sudip Mukherjee
2015-09-10 620 if (spidev->spi) 9169051617df7f Mark
Brown 2014-11-08 621
spidev->speed_hz = spidev->spi->max_speed_hz; 9169051617df7f Mark
Brown 2014-11-08 622 b2c8daddcbe03a David Brownell
2008-06-05 623 /* ... after we unbound from the
underlying device? */ b2c8daddcbe03a David Brownell 2008-06-05
624 dofree = (spidev->spi == NULL); b2c8daddcbe03a
David Brownell 2008-06-05 625
spin_unlock_irq(&spidev->spi_lock); b2c8daddcbe03a David Brownell
2008-06-05 626 b2c8daddcbe03a David Brownell 2008-06-05 627
if (dofree) b2c8daddcbe03a David Brownell
2008-06-05 @628 kfree(spidev);
814a8d50eb1d88 Andrea Paterniani 2007-05-08 629 }
9f918a728cf86b Lukasz Majewski 2019-09-25 630 #ifdef
CONFIG_SPI_SLAVE 9f918a728cf86b Lukasz Majewski 2019-09-25 @631
spi_slave_abort(spidev->spi); 9f918a728cf86b Lukasz Majewski
2019-09-25 632 #endif 814a8d50eb1d88 Andrea Paterniani 2007-05-08
633 mutex_unlock(&device_list_lock); 814a8d50eb1d88 Andrea
Paterniani 2007-05-08 634 99472cc08a8bda Fabio Estevam
2015-05-09 635 return 0; 814a8d50eb1d88 Andrea Paterniani
2007-05-08 636 } 814a8d50eb1d88 Andrea Paterniani 2007-05-08 637
---
0-DAY kernel test infrastructure Open Source
Technology Center
https://lists.01.org/pipermail/kbuild-all
Intel Corporation
Best regards,
Lukasz Majewski
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-59 Fax: (+49)-8142-66989-80 Email: lukma(a)denx.de