There seems to be a potential use after free on line 631.

julia ---------- Forwarded message ---------- Date: Sat, 28 Sep 2019 01:40:25 +0800 From: kbuild test robot <lkp(a)intel.com&gt; To: kbuild(a)01.org Cc: Julia Lawall <julia.lawall(a)lip6.fr&gt; Subject: [linux-next:pending-fixes 12639/12689] drivers/spi/spidev.c:631:17-23: ERROR: reference preceded by free on line 628 CC: kbuild-all(a)01.org TO: Lukasz Majewski <lukma(a)denx.de&gt; CC: Mark Brown <broonie(a)kernel.org&gt; tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git pending-fixes head: d20eeb14322b02c728ce7fe77d41be77a3a37494 commit: 9f918a728cf86b2757b6a7025e1f46824bfe3155 [12639/12689] spi: Add call to spi_slave_abort() function when spidev driver is released :::::: branch date: 26 hours ago :::::: commit date: 2 days ago If you fix the issue, kindly add following tag Reported-by: kbuild test robot <lkp(a)intel.com&gt; Reported-by: Julia Lawall <julia.lawall(a)lip6.fr&gt; >> drivers/spi/spidev.c:631:17-23: ERROR: reference preceded by free >> on line 628 # https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commi... git remote add linux-next https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git git remote update linux-next git checkout 9f918a728cf86b2757b6a7025e1f46824bfe3155 vim +631 drivers/spi/spidev.c 814a8d50eb1d88 Andrea Paterniani 2007-05-08 599 814a8d50eb1d88 Andrea Paterniani 2007-05-08 600 static int spidev_release(struct inode *inode, struct file *filp) 814a8d50eb1d88 Andrea Paterniani 2007-05-08 601 { 814a8d50eb1d88 Andrea Paterniani 2007-05-08 602 struct spidev_data *spidev; 814a8d50eb1d88 Andrea Paterniani 2007-05-08 603 814a8d50eb1d88 Andrea Paterniani 2007-05-08 604 mutex_lock(&device_list_lock); 814a8d50eb1d88 Andrea Paterniani 2007-05-08 605 spidev = filp->private_data; 814a8d50eb1d88 Andrea Paterniani 2007-05-08 606 filp->private_data = NULL; b2c8daddcbe03a David Brownell 2008-06-05 607 b2c8daddcbe03a David Brownell 2008-06-05 608 /* last close? */ 814a8d50eb1d88 Andrea Paterniani 2007-05-08 609 spidev->users--; 814a8d50eb1d88 Andrea Paterniani 2007-05-08 610 if (!spidev->users) { b2c8daddcbe03a David Brownell 2008-06-05 611 int dofree; b2c8daddcbe03a David Brownell 2008-06-05 612 865f6d1974ddd9 Ray Jui 2014-10-09 613 kfree(spidev->tx_buffer); 865f6d1974ddd9 Ray Jui 2014-10-09 614 spidev->tx_buffer = NULL; 865f6d1974ddd9 Ray Jui 2014-10-09 615 865f6d1974ddd9 Ray Jui 2014-10-09 616 kfree(spidev->rx_buffer); 865f6d1974ddd9 Ray Jui 2014-10-09 617 spidev->rx_buffer = NULL; b2c8daddcbe03a David Brownell 2008-06-05 618 56ea1075e7f077 Mark Brown 2015-11-16 619 spin_lock_irq(&spidev->spi_lock); dd85ebf681ef0e Sudip Mukherjee 2015-09-10 620 if (spidev->spi) 9169051617df7f Mark Brown 2014-11-08 621 spidev->speed_hz = spidev->spi->max_speed_hz; 9169051617df7f Mark Brown 2014-11-08 622 b2c8daddcbe03a David Brownell 2008-06-05 623 /* ... after we unbound from the underlying device? */ b2c8daddcbe03a David Brownell 2008-06-05 624 dofree = (spidev->spi == NULL); b2c8daddcbe03a David Brownell 2008-06-05 625 spin_unlock_irq(&spidev->spi_lock); b2c8daddcbe03a David Brownell 2008-06-05 626 b2c8daddcbe03a David Brownell 2008-06-05 627 if (dofree) b2c8daddcbe03a David Brownell 2008-06-05 @628 kfree(spidev); 814a8d50eb1d88 Andrea Paterniani 2007-05-08 629 } 9f918a728cf86b Lukasz Majewski 2019-09-25 630 #ifdef CONFIG_SPI_SLAVE 9f918a728cf86b Lukasz Majewski 2019-09-25 @631 spi_slave_abort(spidev->spi); 9f918a728cf86b Lukasz Majewski 2019-09-25 632 #endif 814a8d50eb1d88 Andrea Paterniani 2007-05-08 633 mutex_unlock(&device_list_lock); 814a8d50eb1d88 Andrea Paterniani 2007-05-08 634 99472cc08a8bda Fabio Estevam 2015-05-09 635 return 0; 814a8d50eb1d88 Andrea Paterniani 2007-05-08 636 } 814a8d50eb1d88 Andrea Paterniani 2007-05-08 637 --- 0-DAY kernel test infrastructure Open Source Technology Center https://lists.01.org/pipermail/kbuild-all Intel Corporation