Hi Aman, kernel test robot noticed the following build warnings: https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Aman-Kumar-Pandey/drivers-i3c-Add-driver-for-NXP-P3H2x4x-i3c-hub-device/20250212-213659 base: https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git for-next patch link: https://lore.kernel.org/r/20250212132227.1348374-2-aman.kumarpandey%40nxp.com patch subject: [PATCH 2/2] drivers: i3c: Add driver for NXP P3H2x4x i3c-hub device config: i386-randconfig-r073-20250215 (https://download.01.org/0day-ci/archive/20250215/202502150815.xfIJk1kS-lkp@xxxxxxxxx/config) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@xxxxxxxxx> | Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> | Closes: https://lore.kernel.org/r/202502150815.xfIJk1kS-lkp@xxxxxxxxx/ smatch warnings: drivers/i3c/p3h2x4x/p3h2x4x_i3c_hub_common.c:412 p3h2x4x_read_backend_from_p3h2x4x_dts() error: buffer overflow 'priv->settings.tp' 8 <= 8 user_rl='0-8' drivers/i3c/p3h2x4x/p3h2x4x_i3c_hub_common.c:572 p3h2x4x_of_get_p3h2x4x_conf() warn: inconsistent indenting drivers/i3c/p3h2x4x/p3h2x4x_i3c_hub_common.c:771 p3h2x4x_device_remove_i3c() error: dereferencing freed memory 'backend' (line 775) drivers/i3c/p3h2x4x/p3h2x4x_i3c_hub_common.c:902 p3h2x4x_device_remove_i2c() error: dereferencing freed memory 'backend' (line 904) vim +370 drivers/i3c/p3h2x4x/p3h2x4x_i3c_hub_common.c 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 392 static int p3h2x4x_read_backend_from_p3h2x4x_dts(struct device_node *i3c_node_target, 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 393 struct p3h2x4x *priv) 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 394 { 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 395 struct device_node *i3c_node_tp; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 396 const char *compatible; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 397 int tp_port, ret; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 398 u32 addr_dts; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 399 struct smbus_device *backend; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 400 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 401 if (sscanf(i3c_node_target->full_name, "target-port@%d", &tp_port) == 0) 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 402 return -EINVAL; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 403 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 404 if (tp_port > P3H2x4x_TP_MAX_COUNT) Change > to >=. 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 405 return -ERANGE; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 406 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 407 if (tp_port < 0) 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 408 return -EINVAL; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 409 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 @410 INIT_LIST_HEAD(&priv->tp_bus[tp_port].tp_device_entry); ^^^^^^^ Off by one. 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 411 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 @412 if (priv->settings.tp[tp_port].mode == P3H2x4x_TP_MODE_I3C) 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 413 return 0; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 414 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 415 for_each_available_child_of_node(i3c_node_target, i3c_node_tp) { 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 416 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 417 ret = of_property_read_u32(i3c_node_tp, "reg", &addr_dts); 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 418 if (ret) 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 419 return ret; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 420 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 421 if (p3h2x4x_is_backend_node_exist(tp_port, priv, addr_dts)) 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 422 continue; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 423 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 424 ret = of_property_read_string(i3c_node_tp, "compatible", &compatible); 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 425 if (ret) 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 426 return ret; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 427 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 428 backend = kzalloc(sizeof(*backend), GFP_KERNEL); 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 429 if (!backend) 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 430 return -ENOMEM; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 431 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 432 backend->addr = addr_dts; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 433 backend->compatible = compatible; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 434 backend->tp_device_dt_node = i3c_node_tp; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 435 backend->client = NULL; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 436 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 437 list_add(&backend->list, 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 438 &priv->tp_bus[tp_port].tp_device_entry); 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 439 } 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 440 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 441 return 0; 5185c1dfec77e7 Aman Kumar Pandey 2025-02-12 442 } -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki
