lkml.org 
[lkml]   [2022]   [Jun]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 1/5] PM / devfreq: Fix cpufreq passive unregister erroring on PROBE_DEFER
Hi Christian,

url: https://github.com/intel-lab-lkp/linux/commits/Christian-Ansuel-Marangi/PM-devfreq-Various-Fixes-to-cpufreq-based-passive-governor/20220606-191335
base: https://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux.git devfreq-testing
config: i386-randconfig-m021 (https://download.01.org/0day-ci/archive/20220610/202206101102.4JCYtCjM-lkp@intel.com/config)
compiler: gcc-11 (Debian 11.3.0-1) 11.3.0

If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

smatch warnings:
drivers/devfreq/governor_passive.c:235 cpufreq_passive_unregister_notifier() error: dereferencing freed memory 'parent_cpu_data'

vim +/parent_cpu_data +235 drivers/devfreq/governor_passive.c

a03dacb0316f74 Saravana Kannan 2021-03-02 221 static int cpufreq_passive_unregister_notifier(struct devfreq *devfreq)
a03dacb0316f74 Saravana Kannan 2021-03-02 222 {
a03dacb0316f74 Saravana Kannan 2021-03-02 223 struct devfreq_passive_data *p_data
a03dacb0316f74 Saravana Kannan 2021-03-02 224 = (struct devfreq_passive_data *)devfreq->data;
a03dacb0316f74 Saravana Kannan 2021-03-02 225 struct devfreq_cpu_data *parent_cpu_data;
2d59e1f0c418bf Christian 'Ansuel' Marangi 2022-06-06 226 int ret;
a03dacb0316f74 Saravana Kannan 2021-03-02 227
a03dacb0316f74 Saravana Kannan 2021-03-02 228 if (p_data->nb.notifier_call) {
a03dacb0316f74 Saravana Kannan 2021-03-02 229 ret = cpufreq_unregister_notifier(&p_data->nb,
a03dacb0316f74 Saravana Kannan 2021-03-02 230 CPUFREQ_TRANSITION_NOTIFIER);
a03dacb0316f74 Saravana Kannan 2021-03-02 231 if (ret < 0)
a03dacb0316f74 Saravana Kannan 2021-03-02 232 return ret;
a03dacb0316f74 Saravana Kannan 2021-03-02 233 }
a03dacb0316f74 Saravana Kannan 2021-03-02 234
2d59e1f0c418bf Christian 'Ansuel' Marangi 2022-06-06 @235 list_for_each_entry(parent_cpu_data, &p_data->cpu_data_list, node) {

This needs to be list_for_each_entry_safe()

26984d9d581e50 Chanwoo Choi 2022-04-27 236 list_del(&parent_cpu_data->node);

Otherwise it will only iterate one time

2d59e1f0c418bf Christian 'Ansuel' Marangi 2022-06-06 237
a03dacb0316f74 Saravana Kannan 2021-03-02 238 if (parent_cpu_data->opp_table)
a03dacb0316f74 Saravana Kannan 2021-03-02 239 dev_pm_opp_put_opp_table(parent_cpu_data->opp_table);
2d59e1f0c418bf Christian 'Ansuel' Marangi 2022-06-06 240
a03dacb0316f74 Saravana Kannan 2021-03-02 241 kfree(parent_cpu_data);

And it will dereference a freed pointer

a03dacb0316f74 Saravana Kannan 2021-03-02 242 }
a03dacb0316f74 Saravana Kannan 2021-03-02 243
2d59e1f0c418bf Christian 'Ansuel' Marangi 2022-06-06 244 return 0;
a03dacb0316f74 Saravana Kannan 2021-03-02 245 }

--
0-DAY CI Kernel Test Service
https://01.org/lkp

\
 
 \ /
  Last update: 2022-06-10 08:44    [W:0.055 / U:0.952 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site