[PATCH v5 13/19] remoteproc: Properly deal with the resource table

[Dan Carpenter]

Hi Mathieu,

url:    https://github.com/0day-ci/linux/commits/Mathieu-Poirier/remoteproc-Add-support-for-detaching-a-remote-processor/20210212-075607
base:   https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git for-next
config: ia64-randconfig-m031-20210209 (attached as .config)
compiler: ia64-linux-gcc (GCC) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp at intel.com>
Reported-by: Dan Carpenter <dan.carpenter at oracle.com>

smatch warnings:
drivers/remoteproc/remoteproc_core.c:2080 rproc_detach() error: double free of 'rproc->cached_table'

vim +2080 drivers/remoteproc/remoteproc_core.c

eab58da78fe46f Mathieu Poirier 2021-02-11  2069  	/* clean up all acquired resources */
eab58da78fe46f Mathieu Poirier 2021-02-11  2070  	rproc_resource_cleanup(rproc);
eab58da78fe46f Mathieu Poirier 2021-02-11  2071  
eab58da78fe46f Mathieu Poirier 2021-02-11  2072  	/* release HW resources if needed */
eab58da78fe46f Mathieu Poirier 2021-02-11  2073  	rproc_unprepare_device(rproc);
eab58da78fe46f Mathieu Poirier 2021-02-11  2074  
eab58da78fe46f Mathieu Poirier 2021-02-11  2075  	rproc_disable_iommu(rproc);
eab58da78fe46f Mathieu Poirier 2021-02-11  2076  
66e2fed7a4bb20 Mathieu Poirier 2021-02-11  2077  	/* Free the copy of the resource table */
66e2fed7a4bb20 Mathieu Poirier 2021-02-11  2078  	kfree(rproc->cached_table);
                                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^
eab58da78fe46f Mathieu Poirier 2021-02-11  2079  	/* Follow the same sequence as in rproc_shutdown() */
eab58da78fe46f Mathieu Poirier 2021-02-11 @2080  	kfree(rproc->cached_table);
                                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^
Double free.

eab58da78fe46f Mathieu Poirier 2021-02-11  2081  	rproc->cached_table = NULL;
66e2fed7a4bb20 Mathieu Poirier 2021-02-11  2082  	rproc->clean_table = NULL;
eab58da78fe46f Mathieu Poirier 2021-02-11  2083  	rproc->table_ptr = NULL;
66e2fed7a4bb20 Mathieu Poirier 2021-02-11  2084  
eab58da78fe46f Mathieu Poirier 2021-02-11  2085  out:
eab58da78fe46f Mathieu Poirier 2021-02-11  2086  	mutex_unlock(&rproc->lock);
eab58da78fe46f Mathieu Poirier 2021-02-11  2087  	return ret;
eab58da78fe46f Mathieu Poirier 2021-02-11  2088  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: .config.gz
Type: application/gzip
Size: 31951 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/linux-arm-kernel/attachments/20210215/8c60ac67/attachment-0001.gz>