[lvc-project] [PATCH] usb: gadget: r8a66597-udc: Fix double free in r8a66597_probe

kernel test robot lkp at intel.com
Tue Sep 17 19:55:16 MSK 2024


Hi Mikhail,

kernel test robot noticed the following build warnings:

[auto build test WARNING on usb/usb-testing]
[also build test WARNING on usb/usb-next usb/usb-linus linus/master v6.11 next-20240917]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Mikhail-Arkhipov/usb-gadget-r8a66597-udc-Fix-double-free-in-r8a66597_probe/20240917-063133
base:   https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
patch link:    https://lore.kernel.org/r/20240916222937.12878-1-m.arhipov%40rosa.ru
patch subject: [PATCH] usb: gadget: r8a66597-udc: Fix double free in r8a66597_probe
config: i386-buildonly-randconfig-001-20240917 (https://download.01.org/0day-ci/archive/20240918/202409180041.GEhgD6dC-lkp@intel.com/config)
compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240918/202409180041.GEhgD6dC-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp at intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202409180041.GEhgD6dC-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> drivers/usb/gadget/udc/r8a66597-udc.c:1962:3: warning: misleading indentation; statement is not part of the previous 'if' [-Wmisleading-indentation]
    1962 |                 r8a66597->ep0_req = NULL;
         |                 ^
   drivers/usb/gadget/udc/r8a66597-udc.c:1960:2: note: previous statement is here
    1960 |         if (r8a66597->ep0_req)
         |         ^
   1 warning generated.


vim +/if +1962 drivers/usb/gadget/udc/r8a66597-udc.c

  1832	
  1833	static int r8a66597_probe(struct platform_device *pdev)
  1834	{
  1835		struct device *dev = &pdev->dev;
  1836		char clk_name[8];
  1837		struct resource *ires;
  1838		int irq;
  1839		void __iomem *reg = NULL;
  1840		struct r8a66597 *r8a66597 = NULL;
  1841		int ret = 0;
  1842		int i;
  1843		unsigned long irq_trigger;
  1844	
  1845		reg = devm_platform_ioremap_resource(pdev, 0);
  1846		if (IS_ERR(reg))
  1847			return PTR_ERR(reg);
  1848	
  1849		ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
  1850		if (!ires)
  1851			return -EINVAL;
  1852		irq = ires->start;
  1853		irq_trigger = ires->flags & IRQF_TRIGGER_MASK;
  1854	
  1855		if (irq < 0) {
  1856			dev_err(dev, "platform_get_irq error.\n");
  1857			return -ENODEV;
  1858		}
  1859	
  1860		/* initialize ucd */
  1861		r8a66597 = devm_kzalloc(dev, sizeof(struct r8a66597), GFP_KERNEL);
  1862		if (r8a66597 == NULL)
  1863			return -ENOMEM;
  1864	
  1865		spin_lock_init(&r8a66597->lock);
  1866		platform_set_drvdata(pdev, r8a66597);
  1867		r8a66597->pdata = dev_get_platdata(dev);
  1868		r8a66597->irq_sense_low = irq_trigger == IRQF_TRIGGER_LOW;
  1869	
  1870		r8a66597->gadget.ops = &r8a66597_gadget_ops;
  1871		r8a66597->gadget.max_speed = USB_SPEED_HIGH;
  1872		r8a66597->gadget.name = udc_name;
  1873	
  1874		timer_setup(&r8a66597->timer, r8a66597_timer, 0);
  1875		r8a66597->reg = reg;
  1876	
  1877		if (r8a66597->pdata->on_chip) {
  1878			snprintf(clk_name, sizeof(clk_name), "usb%d", pdev->id);
  1879			r8a66597->clk = devm_clk_get(dev, clk_name);
  1880			if (IS_ERR(r8a66597->clk)) {
  1881				dev_err(dev, "cannot get clock \"%s\"\n", clk_name);
  1882				return PTR_ERR(r8a66597->clk);
  1883			}
  1884			clk_prepare_enable(r8a66597->clk);
  1885		}
  1886	
  1887		if (r8a66597->pdata->sudmac) {
  1888			ret = r8a66597_sudmac_ioremap(r8a66597, pdev);
  1889			if (ret < 0)
  1890				goto clean_up2;
  1891		}
  1892	
  1893		disable_controller(r8a66597); /* make sure controller is disabled */
  1894	
  1895		ret = devm_request_irq(dev, irq, r8a66597_irq, IRQF_SHARED,
  1896				       udc_name, r8a66597);
  1897		if (ret < 0) {
  1898			dev_err(dev, "request_irq error (%d)\n", ret);
  1899			goto clean_up2;
  1900		}
  1901	
  1902		INIT_LIST_HEAD(&r8a66597->gadget.ep_list);
  1903		r8a66597->gadget.ep0 = &r8a66597->ep[0].ep;
  1904		INIT_LIST_HEAD(&r8a66597->gadget.ep0->ep_list);
  1905		for (i = 0; i < R8A66597_MAX_NUM_PIPE; i++) {
  1906			struct r8a66597_ep *ep = &r8a66597->ep[i];
  1907	
  1908			if (i != 0) {
  1909				INIT_LIST_HEAD(&r8a66597->ep[i].ep.ep_list);
  1910				list_add_tail(&r8a66597->ep[i].ep.ep_list,
  1911						&r8a66597->gadget.ep_list);
  1912			}
  1913			ep->r8a66597 = r8a66597;
  1914			INIT_LIST_HEAD(&ep->queue);
  1915			ep->ep.name = r8a66597_ep_name[i];
  1916			ep->ep.ops = &r8a66597_ep_ops;
  1917			usb_ep_set_maxpacket_limit(&ep->ep, 512);
  1918	
  1919			if (i == 0) {
  1920				ep->ep.caps.type_control = true;
  1921			} else {
  1922				ep->ep.caps.type_iso = true;
  1923				ep->ep.caps.type_bulk = true;
  1924				ep->ep.caps.type_int = true;
  1925			}
  1926			ep->ep.caps.dir_in = true;
  1927			ep->ep.caps.dir_out = true;
  1928		}
  1929		usb_ep_set_maxpacket_limit(&r8a66597->ep[0].ep, 64);
  1930		r8a66597->ep[0].pipenum = 0;
  1931		r8a66597->ep[0].fifoaddr = CFIFO;
  1932		r8a66597->ep[0].fifosel = CFIFOSEL;
  1933		r8a66597->ep[0].fifoctr = CFIFOCTR;
  1934		r8a66597->ep[0].pipectr = get_pipectr_addr(0);
  1935		r8a66597->pipenum2ep[0] = &r8a66597->ep[0];
  1936		r8a66597->epaddr2ep[0] = &r8a66597->ep[0];
  1937	
  1938		r8a66597->ep0_req = r8a66597_alloc_request(&r8a66597->ep[0].ep,
  1939								GFP_KERNEL);
  1940		if (r8a66597->ep0_req == NULL) {
  1941			ret = -ENOMEM;
  1942			goto clean_up2;
  1943		}
  1944		r8a66597->ep0_req->complete = nop_completion;
  1945	
  1946		ret = usb_add_gadget_udc(dev, &r8a66597->gadget);
  1947		if (ret)
  1948			goto err_add_udc;
  1949	
  1950		dev_info(dev, "version %s\n", DRIVER_VERSION);
  1951		return 0;
  1952	
  1953	err_add_udc:
  1954		r8a66597_free_request(&r8a66597->ep[0].ep, r8a66597->ep0_req);
  1955		r8a66597->ep0_req = NULL;
  1956	clean_up2:
  1957		if (r8a66597->pdata->on_chip)
  1958			clk_disable_unprepare(r8a66597->clk);
  1959	
  1960		if (r8a66597->ep0_req)
  1961			r8a66597_free_request(&r8a66597->ep[0].ep, r8a66597->ep0_req);
> 1962			r8a66597->ep0_req = NULL;
  1963	
  1964		return ret;
  1965	}
  1966	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki



More information about the lvc-project mailing list