On Tue, Feb 04, 2020 at 10:00:09AM +0300, Dan Carpenter wrote:
> Hello Srinivas Pandruvada,
>
> The patch 49a474c7ba51: "platform/x86: Add support for Uncore
> frequency control" from Jan 13, 2020, leads to the following static
> checker warning:
>
> drivers/platform/x86/intel-uncore-frequency.c:285 uncore_remove_die_entry()
> error: dereferencing freed memory 'data'
>
> drivers/platform/x86/intel-uncore-frequency.c
> 276 /* Last CPU in this die is offline, so remove sysfs entries */
> 277 static void uncore_remove_die_entry(int cpu)
> 278 {
> 279 struct uncore_data *data;
> 280
> 281 mutex_lock(&uncore_lock);
> 282 data = uncore_get_instance(cpu);
> 283 if (data) {
> 284 kobject_put(&data->kobj);
> ^^^^^^^^^^^^^^^^^^^^^^^^
> This leads to a slightly delayed free.
These static checker warnings are new and I'm still working out the
kinks. This doesn't actually free anything, but it's not right either
it seems? The uncore_ktype struct doesn't have a release function so
won't kobject_cleanup() complain?
lib/kobject.c
664 static void kobject_cleanup(struct kobject *kobj)
665 {
666 struct kobj_type *t = get_ktype(kobj);
667 const char *name = kobj->name;
668
669 pr_debug("kobject: '%s' (%p): %s, parent %p\n",
670 kobject_name(kobj), kobj, __func__, kobj->parent);
671
672 if (t && !t->release)
673 pr_debug("kobject: '%s' (%p): does not have a release() function, it is broken and must be fixed. See Documentation/kobject.txt.\n",
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
674 kobject_name(kobj), kobj);
regards,
dan carpenter
