drivers/firmware/xilinx/zynqmp.c:1288 zynqmp_firmware_remove() error: dereferencing freed memory 'feature_data'

[Dan Carpenter]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   f5e6c330254ae691f6d7befe61c786eb5056007e
commit: acfdd18591eaac25446e976a0c0d190f8b3dbfb1 firmware: xilinx: Use hash-table for api feature check
config: arm64-randconfig-m031-20210108 (attached as .config)
compiler: aarch64-linux-gcc (GCC) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@xxxxxxxxx>
Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>

smatch warnings:
drivers/firmware/xilinx/zynqmp.c:1288 zynqmp_firmware_remove() error: dereferencing freed memory 'feature_data'

vim +/feature_data +1288 drivers/firmware/xilinx/zynqmp.c

76582671eb5d006 Rajan Vaja        2018-09-12  1280  static int zynqmp_firmware_remove(struct platform_device *pdev)
76582671eb5d006 Rajan Vaja        2018-09-12  1281  {
acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23  1282  	struct pm_api_feature_data *feature_data;
acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23  1283  	int i;
acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23  1284  
e23d9c6d0d4912f Jolly Shah        2019-02-01  1285  	mfd_remove_devices(&pdev->dev);
b321725257c1733 Rajan Vaja        2018-09-12  1286  	zynqmp_pm_api_debugfs_exit();
b321725257c1733 Rajan Vaja        2018-09-12  1287  
acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23 @1288  	hash_for_each(pm_api_features_map, i, feature_data, hentry) {

This has to use hash_for_each_safe().

acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23  1289  		hash_del(&feature_data->hentry);
acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23  1290  		kfree(feature_data);
acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23  1291  	}
acfdd18591eaac2 Amit Sunil Dhamne 2020-11-23  1292  
76582671eb5d006 Rajan Vaja        2018-09-12  1293  	return 0;
76582671eb5d006 Rajan Vaja        2018-09-12  1294  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@xxxxxxxxxxxx

Attachment: .config.gz
Description: application/gzip