Re: [PATCH 2/2] leds: triggers: gpio: Rewrite to use trigger-sources

From: Dan Carpenter
Date: Thu Sep 14 2023 - 06:21:51 EST


Hi Linus,

kernel test robot noticed the following build warnings:

url: https://github.com/intel-lab-lkp/linux/commits/Linus-Walleij/dt-bindings-leds-Mention-GPIO-triggers/20230912-214554
base: 0bb80ecc33a8fb5a682236443c1e740d5c917d1d
patch link: https://lore.kernel.org/r/20230912-gpio-led-trigger-dt-v1-2-1b50e3756dda%40linaro.org
patch subject: [PATCH 2/2] leds: triggers: gpio: Rewrite to use trigger-sources
config: x86_64-randconfig-161-20230913 (https://download.01.org/0day-ci/archive/20230914/202309140825.cVUTHU1K-lkp@xxxxxxxxx/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce: (https://download.01.org/0day-ci/archive/20230914/202309140825.cVUTHU1K-lkp@xxxxxxxxx/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
| Closes: https://lore.kernel.org/r/202309140825.cVUTHU1K-lkp@xxxxxxxxx/

smatch warnings:
drivers/leds/trigger/ledtrig-gpio.c:98 gpio_trig_activate() error: dereferencing freed memory 'gpio_data'

vim +/gpio_data +98 drivers/leds/trigger/ledtrig-gpio.c

2282e125a406e0 drivers/leds/trigger/ledtrig-gpio.c Uwe Kleine-König 2018-07-02 78 static int gpio_trig_activate(struct led_classdev *led)
17354bfe85275f drivers/leds/ledtrig-gpio.c Felipe Balbi 2009-02-17 79 {
17354bfe85275f drivers/leds/ledtrig-gpio.c Felipe Balbi 2009-02-17 80 struct gpio_trig_data *gpio_data;
2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 81 struct device *dev = led->dev;
2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 82 int ret;
17354bfe85275f drivers/leds/ledtrig-gpio.c Felipe Balbi 2009-02-17 83
17354bfe85275f drivers/leds/ledtrig-gpio.c Felipe Balbi 2009-02-17 84 gpio_data = kzalloc(sizeof(*gpio_data), GFP_KERNEL);
17354bfe85275f drivers/leds/ledtrig-gpio.c Felipe Balbi 2009-02-17 85 if (!gpio_data)
9bfd7d9e5d6353 drivers/leds/trigger/ledtrig-gpio.c Uwe Kleine-König 2018-07-02 86 return -ENOMEM;
17354bfe85275f drivers/leds/ledtrig-gpio.c Felipe Balbi 2009-02-17 87
2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 88 /*
2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 89 * The generic property "trigger-sources" is followed,
2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 90 * and we hope that this is a GPIO.
2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 91 */
2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 92 gpio_data->gpiod = fwnode_gpiod_get_index(dev->fwnode,
2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 93 "trigger-sources",
2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 94 0, GPIOD_IN,
2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 95 "led-trigger");
2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 96 if (IS_ERR(gpio_data->gpiod)) {
2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 97 kfree(gpio_data);
^^^^^^^^^^^^^^^^

2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 @98 return PTR_ERR(gpio_data->gpiod);
^^^^^^^^^^^^^^^^
Dereferencing freed memory.

2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 99 }
2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 100 if (!gpio_data->gpiod) {
2689cea6283a47 drivers/leds/trigger/ledtrig-gpio.c Linus Walleij 2023-09-12 101 dev_err(dev, "no valid GPIO for the trigger\n");

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki