tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 55f62bc873477dae2c45bbbc30b86cf3e0982f3b
commit: 5a6338cce9f4133c478d3b10b300f96dd644379a mailbox: arm_mhuv2: Add driver
config: arm64-randconfig-m031-20210221 (attached as .config)
compiler: aarch64-linux-gcc (GCC) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <[email protected]>
Reported-by: Dan Carpenter <[email protected]>
smatch warnings:
drivers/mailbox/arm_mhuv2.c:702 mhuv2_receiver_interrupt() error: 'data' dereferencing possible ERR_PTR()
vim +/data +702 drivers/mailbox/arm_mhuv2.c
5a6338cce9f413 Viresh Kumar 2020-11-17 674 static irqreturn_t mhuv2_receiver_interrupt(int irq, void *arg)
5a6338cce9f413 Viresh Kumar 2020-11-17 675 {
5a6338cce9f413 Viresh Kumar 2020-11-17 676 struct mhuv2 *mhu = arg;
5a6338cce9f413 Viresh Kumar 2020-11-17 677 struct mbox_chan *chan = get_irq_chan_rx(mhu);
5a6338cce9f413 Viresh Kumar 2020-11-17 678 struct device *dev = mhu->mbox.dev;
5a6338cce9f413 Viresh Kumar 2020-11-17 679 struct mhuv2_mbox_chan_priv *priv;
5a6338cce9f413 Viresh Kumar 2020-11-17 680 int ret = IRQ_NONE;
5a6338cce9f413 Viresh Kumar 2020-11-17 681 void *data;
5a6338cce9f413 Viresh Kumar 2020-11-17 682
5a6338cce9f413 Viresh Kumar 2020-11-17 683 if (IS_ERR(chan)) {
5a6338cce9f413 Viresh Kumar 2020-11-17 684 dev_warn(dev, "Failed to find channel for the rx interrupt\n");
5a6338cce9f413 Viresh Kumar 2020-11-17 685 return IRQ_NONE;
5a6338cce9f413 Viresh Kumar 2020-11-17 686 }
5a6338cce9f413 Viresh Kumar 2020-11-17 687 priv = chan->con_priv;
5a6338cce9f413 Viresh Kumar 2020-11-17 688
5a6338cce9f413 Viresh Kumar 2020-11-17 689 /* Read and clear the data first */
5a6338cce9f413 Viresh Kumar 2020-11-17 690 data = priv->ops->read_data(mhu, chan);
5a6338cce9f413 Viresh Kumar 2020-11-17 691
5a6338cce9f413 Viresh Kumar 2020-11-17 692 if (!chan->cl) {
5a6338cce9f413 Viresh Kumar 2020-11-17 693 dev_warn(dev, "Received data on channel (%u) not currently attached to a mailbox client\n",
5a6338cce9f413 Viresh Kumar 2020-11-17 694 priv->ch_wn_idx);
5a6338cce9f413 Viresh Kumar 2020-11-17 695 } else if (IS_ERR(data)) {
5a6338cce9f413 Viresh Kumar 2020-11-17 696 dev_err(dev, "Failed to read data: %lu\n", PTR_ERR(data));
"data" is an error pointer.
5a6338cce9f413 Viresh Kumar 2020-11-17 697 } else {
5a6338cce9f413 Viresh Kumar 2020-11-17 698 mbox_chan_received_data(chan, data);
5a6338cce9f413 Viresh Kumar 2020-11-17 699 ret = IRQ_HANDLED;
5a6338cce9f413 Viresh Kumar 2020-11-17 700 }
5a6338cce9f413 Viresh Kumar 2020-11-17 701
5a6338cce9f413 Viresh Kumar 2020-11-17 @702 kfree(data);
^^^^^^^^^^^
This will crash.
5a6338cce9f413 Viresh Kumar 2020-11-17 703 return ret;
5a6338cce9f413 Viresh Kumar 2020-11-17 704 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]