Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 14 Sep 2021 12:58:30 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     kbuild@lists.01.org, Ian Pilcher <arequipeno@gmail.com>,
        axboe@kernel.dk, pavel@ucw.cz
Cc:     lkp@intel.com, kbuild-all@lists.01.org, linux-leds@vger.kernel.org,
        linux-block@vger.kernel.org, linux-kernel@vger.kernel.org,
        gregkh@linuxfoundation.org, kabel@kernel.org
Subject: Re: [PATCH v2 12/15] leds: trigger: blkdev: Enable unlinking block
 devices from LEDs
Message-ID: <202109121556.LgmETrer-lkp@intel.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210909222513.2184795-13-arequipeno@gmail.com>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?bPqoikYGwKypuLLpRBY96SkYKN9xyNJlchm9o5u8yLVzNevEwB+ZPULYbyUo?=
 =?us-ascii?Q?X+tIXd79mS6Zp9fBuzP6kgYrjKpvzwmQsDWwFCrb8nSvbKZP8loDV7vXVICW?=
 =?us-ascii?Q?feasqJWJzku+bSks9kGThM4NFaB8aS8R8FadYEIatEIxIxrOH05g4a0Kn4fO?=
 =?us-ascii?Q?B4cUnbn0lRQuXFGb6NKGkOKYOqOV6hHMTR1rvuiqJqusTQjsxpcH/QqdVX0/?=
 =?us-ascii?Q?CEA4c41/aCe1TnY0n7ZJR4YcUlW9Scb5Dy6ilSVAg5XgPWreUjs+KJqQjRye?=
 =?us-ascii?Q?y2th7E5k87lt1iDT0GyyBGOG7tJ5spI6Y33EEhObIf/dPlCSKxiEIrwZo8NE?=
 =?us-ascii?Q?Xq0z70AZB7BYKGNPbFYMlQ2RDn1e8e6TNV5AePIBcrVjuFhV2AQ8UXWer4yZ?=
 =?us-ascii?Q?eSm5jGEIAmZVvnuq6lpmx5ZPq5D8QLDFE0R1O/w1blYTq8t+c+9+firvXP4B?=
 =?us-ascii?Q?ummg7zv9ZQOtP4tqRCVGqzOxJJINAnYOoVV30mMjVeC3rTOh/1dCY/yq41dt?=
 =?us-ascii?Q?ubES6dRnoyKmLr27hqrFyi6L+KvdjyA0xoJDOLlB6ivRfZsXr+QzH984ogvO?=
 =?us-ascii?Q?H2e4nNCt9TTHQYn2Jnl0L/dBwM4P7q5hdnnmJzfekjvARFr22ridprxOqux0?=
 =?us-ascii?Q?J4E2/qyvmKxLKUPKUc+SF+NG7vnp+yKCyYUBRJeAIGYqZPb+PsQB9uxJmEkk?=
 =?us-ascii?Q?U/eeJHppCX0MjztjV9xjXQ2o5BL92dFjXOaQ0fFqwQNwUcjKIALOHORSPdDa?=
 =?us-ascii?Q?2CZBOLK8JckpzVxlTbTvBXZKQnOxnXv6rr2CcjtDjNeYgeaWKuc3UYLrwNRv?=
 =?us-ascii?Q?BnBtf5FYrbEUQy6GmwRuhswF3sXI4OBtI/Vmoc0RSyLIEv434h1N5GvBSihS?=
 =?us-ascii?Q?yC3S+XvM2F/QWvTUCMgSw4Oj9uVFIU8NXoE3QnO7kWPzURxOhvAJG/pJ2FTV?=
 =?us-ascii?Q?kIiU1BnBj/TH1hHi+ieJFodbbszMBq4meCsY8IaYZ/+BouOP1x5/EJlo0Sxf?=
 =?us-ascii?Q?tBGbDwePk2NLs/ICvLafFNU6ec7/pIKVK4iNrwpT2fGADg3EAiPwWaP6UBVo?=
 =?us-ascii?Q?mGcSwdz2TorgUpREf0Lg4O2sQZT4RBdQErgVFTp7H1K5wgzN2D9mYIKUqrAD?=
 =?us-ascii?Q?tQe1ROZ9dS0JiiB7f93/bw29pHcYaaYKDu5RzWO535gNIF2KXj6bkKoECFoC?=
 =?us-ascii?Q?ihtJ+613gHhg0b0iobaST6lo+XLpPvP0Gas8QXEtFsRur0LhiYf0qK9b4zST?=
 =?us-ascii?Q?4EbNOJavOLolF/bGVHElsgSpzKCLToTJdJNt/gvFDnbIdH4laMfi9lKkoAWF?=
 =?us-ascii?Q?Gaqa337t1ZcwMQ03naWjWLe8?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c7783a8f-83af-41f2-f38d-08d977663e2b
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2021 09:58:46.5941
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: iVwedYq9PG0km0rjhM4YnRDggH/iHn+3078SddyRGZ2duiOZa9FDgkD2heo9GyhsSR60w4ChSMspFHENPpxBgfs0QKZzc5G0mIu/GB01KwE=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR1001MB2398
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10106 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 adultscore=0 suspectscore=0
 phishscore=0 mlxlogscore=999 malwarescore=0 mlxscore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001
 definitions=main-2109140060
X-Proofpoint-GUID: PLtDMYWdHNIdApSxC7R8ir9t94OdfNAD
X-Proofpoint-ORIG-GUID: PLtDMYWdHNIdApSxC7R8ir9t94OdfNAD
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Ian,

url:    https://github.com/0day-ci/linux/commits/Ian-Pilcher/Introduce-block-device-LED-trigger/20210910-062756
base:   a3fa7a101dcff93791d1b1bdb3affcad1410c8c1
config: i386-randconfig-m021-20210912 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

smatch warnings:
drivers/leds/trigger/ledtrig-blkdev.c:410 blkdev_disk_unlink_locked() error: dereferencing freed memory 'disk'

vim +/disk +410 drivers/leds/trigger/ledtrig-blkdev.c

66cb682de7e8bd Ian Pilcher 2021-09-09  388  static void blkdev_disk_unlink_locked(struct ledtrig_blkdev_led *const led,
66cb682de7e8bd Ian Pilcher 2021-09-09  389  				      struct ledtrig_blkdev_link *const link,
66cb682de7e8bd Ian Pilcher 2021-09-09  390  				      struct ledtrig_blkdev_disk *const disk)
66cb682de7e8bd Ian Pilcher 2021-09-09  391  {
66cb682de7e8bd Ian Pilcher 2021-09-09  392  	--ledtrig_blkdev_count;
66cb682de7e8bd Ian Pilcher 2021-09-09  393  
66cb682de7e8bd Ian Pilcher 2021-09-09  394  	if (ledtrig_blkdev_count == 0)
66cb682de7e8bd Ian Pilcher 2021-09-09  395  		WARN_ON(!cancel_delayed_work_sync(&ledtrig_blkdev_work));
66cb682de7e8bd Ian Pilcher 2021-09-09  396  
66cb682de7e8bd Ian Pilcher 2021-09-09  397  	sysfs_remove_link(led->dir, disk->gd->disk_name);
66cb682de7e8bd Ian Pilcher 2021-09-09  398  	sysfs_remove_link(disk->dir, led->led_dev->name);
66cb682de7e8bd Ian Pilcher 2021-09-09  399  	kobject_put(disk->dir);
66cb682de7e8bd Ian Pilcher 2021-09-09  400  
66cb682de7e8bd Ian Pilcher 2021-09-09  401  	hlist_del(&link->led_disks_node);
66cb682de7e8bd Ian Pilcher 2021-09-09  402  	hlist_del(&link->disk_leds_node);
66cb682de7e8bd Ian Pilcher 2021-09-09  403  	kfree(link);
66cb682de7e8bd Ian Pilcher 2021-09-09  404  
66cb682de7e8bd Ian Pilcher 2021-09-09  405  	if (hlist_empty(&disk->leds)) {
66cb682de7e8bd Ian Pilcher 2021-09-09  406  		disk->gd->ledtrig = NULL;
66cb682de7e8bd Ian Pilcher 2021-09-09  407  		kfree(disk);
                                                              ^^^^
Freed.

66cb682de7e8bd Ian Pilcher 2021-09-09  408  	}
66cb682de7e8bd Ian Pilcher 2021-09-09  409  
66cb682de7e8bd Ian Pilcher 2021-09-09 @410  	put_disk(disk->gd);
                                                         ^^^^^^^^
Dereference after free.

66cb682de7e8bd Ian Pilcher 2021-09-09  411  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org