Hi Lizhi, url: https://github.com/0day-ci/linux/commits/Lizhi-Hou/Infrastructure-to-define-apertures-in-a-PCIe-device-with-a-flattened-device-tree/20220307-141939 base: https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git for-next config: i386-randconfig-m021-20220307 (https://download.01.org/0day-ci/archive/20220310/202203100338.8jox1rCr-lkp@xxxxxxxxx/config) compiler: gcc-9 (Debian 9.3.0-22) 9.3.0 If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp@xxxxxxxxx> Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> smatch warnings: drivers/pci/of.c:762 devm_of_pci_create_bus_endpoint() error: double free of 'prop' vim +/prop +762 drivers/pci/of.c 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 677 int devm_of_pci_create_bus_endpoint(struct pci_dev *pdev) 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 678 { 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 679 struct property *proplist = NULL; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 680 struct device *dev = &pdev->dev; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 681 int range_ncells, addr_ncells; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 682 struct device_node *node; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 683 void *prop = NULL; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 684 u32 *range_cell; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 685 __be32 val; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 686 int i, ret; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 687 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 688 node = of_ep_alloc_node(pdev, "pci-ep-bus"); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 689 if (!node) 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 690 return -ENOMEM; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 691 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 692 /* the endpoint node works as 'simple-bus' to translate aperture addresses. */ 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 693 prop = "simple-bus"; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 694 ret = of_ep_add_property(dev, &proplist, "compatible", strlen(prop) + 1, prop); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 695 if (ret) 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 696 goto cleanup; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 697 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 698 /* The address and size cells of nodes underneath are 2 */ 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 699 val = cpu_to_be32(2); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 700 ret = of_ep_add_property(dev, &proplist, "#address-cells", sizeof(u32), &val); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 701 if (ret) 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 702 goto cleanup; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 703 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 704 ret = of_ep_add_property(dev, &proplist, "#size-cells", sizeof(u32), &val); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 705 if (ret) 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 706 goto cleanup; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 707 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 708 /* child address format: 0xIooooooo oooooooo, I = bar index, o = offset on bar */ 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 709 addr_ncells = of_n_addr_cells(node); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 710 if (addr_ncells > 2) { 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 711 /* does not support number of address cells greater than 2 */ 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 712 ret = -EINVAL; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 713 goto cleanup; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 714 } 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 715 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 716 /* range cells include <node addr cells> <child addr cells> <child size cells> */ 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 717 range_ncells = addr_ncells + 4; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 718 prop = kzalloc(range_ncells * sizeof(u32) * PCI_STD_NUM_BARS, GFP_KERNEL); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 719 if (!prop) { 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 720 ret = -ENOMEM; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 721 goto cleanup; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 722 } 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 723 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 724 range_cell = prop; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 725 for (i = 0; i < PCI_STD_NUM_BARS; i++) { 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 726 if (!pci_resource_len(pdev, i)) 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 727 continue; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 728 /* highest 4 bits of address are bar index */ 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 729 *(__be64 *)range_cell = cpu_to_be64((u64)i << 60); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 730 range_cell += 2; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 731 if (addr_ncells == 2) 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 732 *(__be64 *)range_cell = cpu_to_be64((u64)pci_resource_start(pdev, i)); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 733 else 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 734 *(__be32 *)range_cell = cpu_to_be32((u32)pci_resource_start(pdev, i)); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 735 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 736 range_cell += addr_ncells; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 737 *(__be64 *)range_cell = cpu_to_be64((u64)pci_resource_len(pdev, i)); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 738 range_cell += 2; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 739 } 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 740 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 741 /* error out if there is not PCI BAR been found */ 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 742 if ((void *)range_cell == prop) { 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 743 ret = -EINVAL; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 744 goto cleanup; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 745 } 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 746 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 747 ret = of_ep_add_property(dev, &proplist, "ranges", (void *)range_cell - prop, prop); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 748 kfree(prop); ^^^^^^^^^^^^ Free 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 749 if (ret) 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 750 goto cleanup; ^^^^^^^^^^^^^ Double free after goto. 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 751 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 752 node->properties = proplist; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 753 ret = of_attach_node(node); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 754 if (ret) 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 755 goto cleanup; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 756 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 757 devres_add(dev, node); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 758 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 759 return 0; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 760 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 761 cleanup: 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 @762 kfree(prop); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 763 if (node) 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 764 devres_free(node); 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 765 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 766 return ret; 3a2c08c0f0ef77 Lizhi Hou 2022-03-04 767 } --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@xxxxxxxxxxxx
