Re: [PATCH V1 RESEND 1/4] pci: add interface to create pci-ep device tree node

From: Dan Carpenter
Date: Thu Mar 10 2022 - 05:03:26 EST

Hi Lizhi,

url: https://github.com/0day-ci/linux/commits/Lizhi-Hou/Infrastructure-to-define-apertures-in-a-PCIe-device-with-a-flattened-device-tree/20220307-141939
base: https://git.kernel.org/pub/scm/linux/kernel/git/robh/linux.git for-next
config: i386-randconfig-m021-20220307 (https://download.01.org/0day-ci/archive/20220310/202203100338.8jox1rCr-lkp@xxxxxxxxx/config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@xxxxxxxxx>
Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>

smatch warnings:
drivers/pci/of.c:762 devm_of_pci_create_bus_endpoint() error: double free of 'prop'

vim +/prop +762 drivers/pci/of.c

3a2c08c0f0ef77 Lizhi Hou 2022-03-04 677 int devm_of_pci_create_bus_endpoint(struct pci_dev *pdev)
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 678 {
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 679 struct property *proplist = NULL;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 680 struct device *dev = &pdev->dev;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 681 int range_ncells, addr_ncells;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 682 struct device_node *node;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 683 void *prop = NULL;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 684 u32 *range_cell;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 685 __be32 val;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 686 int i, ret;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 687
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 688 node = of_ep_alloc_node(pdev, "pci-ep-bus");
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 689 if (!node)
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 690 return -ENOMEM;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 691
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 692 /* the endpoint node works as 'simple-bus' to translate aperture addresses. */
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 693 prop = "simple-bus";
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 694 ret = of_ep_add_property(dev, &proplist, "compatible", strlen(prop) + 1, prop);
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 695 if (ret)
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 696 goto cleanup;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 697
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 698 /* The address and size cells of nodes underneath are 2 */
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 699 val = cpu_to_be32(2);
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 700 ret = of_ep_add_property(dev, &proplist, "#address-cells", sizeof(u32), &val);
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 701 if (ret)
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 702 goto cleanup;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 703
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 704 ret = of_ep_add_property(dev, &proplist, "#size-cells", sizeof(u32), &val);
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 705 if (ret)
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 706 goto cleanup;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 707
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 708 /* child address format: 0xIooooooo oooooooo, I = bar index, o = offset on bar */
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 709 addr_ncells = of_n_addr_cells(node);
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 710 if (addr_ncells > 2) {
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 711 /* does not support number of address cells greater than 2 */
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 712 ret = -EINVAL;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 713 goto cleanup;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 714 }
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 715
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 716 /* range cells include <node addr cells> <child addr cells> <child size cells> */
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 717 range_ncells = addr_ncells + 4;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 718 prop = kzalloc(range_ncells * sizeof(u32) * PCI_STD_NUM_BARS, GFP_KERNEL);
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 719 if (!prop) {
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 720 ret = -ENOMEM;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 721 goto cleanup;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 722 }
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 723
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 724 range_cell = prop;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 725 for (i = 0; i < PCI_STD_NUM_BARS; i++) {
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 726 if (!pci_resource_len(pdev, i))
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 727 continue;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 728 /* highest 4 bits of address are bar index */
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 729 *(__be64 *)range_cell = cpu_to_be64((u64)i << 60);
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 730 range_cell += 2;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 731 if (addr_ncells == 2)
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 732 *(__be64 *)range_cell = cpu_to_be64((u64)pci_resource_start(pdev, i));
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 733 else
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 734 *(__be32 *)range_cell = cpu_to_be32((u32)pci_resource_start(pdev, i));
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 735
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 736 range_cell += addr_ncells;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 737 *(__be64 *)range_cell = cpu_to_be64((u64)pci_resource_len(pdev, i));
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 738 range_cell += 2;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 739 }
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 740
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 741 /* error out if there is not PCI BAR been found */
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 742 if ((void *)range_cell == prop) {
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 743 ret = -EINVAL;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 744 goto cleanup;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 745 }
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 746
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 747 ret = of_ep_add_property(dev, &proplist, "ranges", (void *)range_cell - prop, prop);
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 748 kfree(prop);
^^^^^^^^^^^^
Free

3a2c08c0f0ef77 Lizhi Hou 2022-03-04 749 if (ret)
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 750 goto cleanup;
^^^^^^^^^^^^^
Double free after goto.


3a2c08c0f0ef77 Lizhi Hou 2022-03-04 751
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 752 node->properties = proplist;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 753 ret = of_attach_node(node);
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 754 if (ret)
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 755 goto cleanup;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 756
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 757 devres_add(dev, node);
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 758
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 759 return 0;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 760
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 761 cleanup:
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 @762 kfree(prop);
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 763 if (node)
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 764 devres_free(node);
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 765
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 766 return ret;
3a2c08c0f0ef77 Lizhi Hou 2022-03-04 767 }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@xxxxxxxxxxxx