tree:   https://chromium.googlesource.com/chromiumos/third_party/kernel 
chromeos-4.14
head:   a43feaa28101d3a705c8b04c2267365d20d8cf25
commit: 6bab3ca364b5d1fdf08a55e1014aa57a3c9efe75 [20/21] FIXUP: CHROMIUM: 
drm/evdi: Parse usb path in evdi's add sysfs attribute
config: parisc-randconfig-m031-20210219 (attached as .config)
compiler: hppa-linux-gcc (GCC) 7.5.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <[email protected]>
Reported-by: Dan Carpenter <[email protected]>

New smatch warnings:
drivers/gpu/drm/evdi/evdi_drv.c:507 add_device_with_usb_path() error: 
uninitialized symbol 'usb_token_copy'.

Old smatch warnings:
drivers/gpu/drm/evdi/evdi_drv.c:341 evdi_driver_setup_early() error: 
dereferencing freed memory 'evdi'
drivers/gpu/drm/evdi/evdi_drv.c:357 evdi_platform_probe() warn: possible memory 
leak of 'data'

vim +/usb_token_copy +507 drivers/gpu/drm/evdi/evdi_drv.c

ef1547c12e0daf Łukasz Spintzyk 2020-12-03  444  
4409c8dfb86066 Łukasz Spintzyk 2020-12-03  445  static int 
evdi_platform_device_attach(struct device *device,
4409c8dfb86066 Łukasz Spintzyk 2020-12-03  446                  struct 
evdi_usb_addr *parent_addr);
4409c8dfb86066 Łukasz Spintzyk 2020-12-03  447  
4409c8dfb86066 Łukasz Spintzyk 2020-12-03  448  static ssize_t 
add_device_with_usb_path(struct device *dev,
014bcd16d12923 Łukasz Spintzyk 2020-12-03  449                           const 
char *buf, size_t count)
014bcd16d12923 Łukasz Spintzyk 2020-12-03  450  {
014bcd16d12923 Łukasz Spintzyk 2020-12-03  451          char *usb_path = 
kstrdup(buf, GFP_KERNEL);
014bcd16d12923 Łukasz Spintzyk 2020-12-03  452          char *temp_path = 
usb_path;
6bab3ca364b5d1 Guenter Roeck   2021-02-18  453          char *bus_token;
6bab3ca364b5d1 Guenter Roeck   2021-02-18  454          char *usb_token;
6bab3ca364b5d1 Guenter Roeck   2021-02-18  455          char *usb_token_copy;
6bab3ca364b5d1 Guenter Roeck   2021-02-18  456          char *token;
6bab3ca364b5d1 Guenter Roeck   2021-02-18  457          char *bus;
6bab3ca364b5d1 Guenter Roeck   2021-02-18  458          char *port;
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  459          struct evdi_usb_addr 
usb_addr;
014bcd16d12923 Łukasz Spintzyk 2020-12-03  460  
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  461          memset(&usb_addr, 0, 
sizeof(usb_addr));
014bcd16d12923 Łukasz Spintzyk 2020-12-03  462          temp_path = 
strnstr(temp_path, "usb:", count);
014bcd16d12923 Łukasz Spintzyk 2020-12-03  463          if (!temp_path)
014bcd16d12923 Łukasz Spintzyk 2020-12-03  464                  goto 
err_parse_usb_path;
                                                                
^^^^^^^^^^^^^^^^^^^^^^^

014bcd16d12923 Łukasz Spintzyk 2020-12-03  465  
014bcd16d12923 Łukasz Spintzyk 2020-12-03  466  
014bcd16d12923 Łukasz Spintzyk 2020-12-03  467          temp_path = 
strim(temp_path);
014bcd16d12923 Łukasz Spintzyk 2020-12-03  468  
014bcd16d12923 Łukasz Spintzyk 2020-12-03  469          bus_token = 
strsep(&temp_path, ":");
014bcd16d12923 Łukasz Spintzyk 2020-12-03  470          if (!bus_token)
014bcd16d12923 Łukasz Spintzyk 2020-12-03  471                  goto 
err_parse_usb_path;
014bcd16d12923 Łukasz Spintzyk 2020-12-03  472  
014bcd16d12923 Łukasz Spintzyk 2020-12-03  473          usb_token = 
strsep(&temp_path, ":");
014bcd16d12923 Łukasz Spintzyk 2020-12-03  474          if (!usb_token)
014bcd16d12923 Łukasz Spintzyk 2020-12-03  475                  goto 
err_parse_usb_path;
014bcd16d12923 Łukasz Spintzyk 2020-12-03  476  
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  477          token = usb_token_copy 
= kstrdup(usb_token, GFP_KERNEL);
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  478          bus = strsep(&token, 
"-");
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  479          if (!bus)
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  480                  goto 
err_parse_usb_path;
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  481          if (kstrtouint(bus, 10, 
&usb_addr.addr[usb_addr.len++]))
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  482                  goto 
err_parse_usb_path;
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  483  
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  484          do {
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  485                  port = 
strsep(&token, ".");
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  486                  if (!port)
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  487                          goto 
err_parse_usb_path;
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  488                  if 
(kstrtouint(port, 10, &usb_addr.addr[usb_addr.len++]))
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  489                          goto 
err_parse_usb_path;
ef1547c12e0daf Łukasz Spintzyk 2020-12-03  490          } while (token && port 
&& usb_addr.len < MAX_EVDI_USB_ADDR);
014bcd16d12923 Łukasz Spintzyk 2020-12-03  491  
4409c8dfb86066 Łukasz Spintzyk 2020-12-03  492          if 
(evdi_platform_device_attach(dev, &usb_addr) != 0) {
4409c8dfb86066 Łukasz Spintzyk 2020-12-03  493                  
EVDI_ERROR("Unable to attach to: %s\n", buf);
4409c8dfb86066 Łukasz Spintzyk 2020-12-03  494                  kfree(usb_path);
4409c8dfb86066 Łukasz Spintzyk 2020-12-03  495                  
kfree(usb_token_copy);
4409c8dfb86066 Łukasz Spintzyk 2020-12-03  496                  return -EINVAL;
4409c8dfb86066 Łukasz Spintzyk 2020-12-03  497          }
4409c8dfb86066 Łukasz Spintzyk 2020-12-03  498  
014bcd16d12923 Łukasz Spintzyk 2020-12-03  499          EVDI_INFO("Attaching to 
%s:%s\n", bus_token, usb_token);
4409c8dfb86066 Łukasz Spintzyk 2020-12-03  500          kfree(usb_path);
4409c8dfb86066 Łukasz Spintzyk 2020-12-03  501          kfree(usb_token_copy);
014bcd16d12923 Łukasz Spintzyk 2020-12-03  502          return count;
014bcd16d12923 Łukasz Spintzyk 2020-12-03  503  
014bcd16d12923 Łukasz Spintzyk 2020-12-03  504  err_parse_usb_path:
014bcd16d12923 Łukasz Spintzyk 2020-12-03  505          EVDI_ERROR("Unable to 
parse usb path: %s", buf);
014bcd16d12923 Łukasz Spintzyk 2020-12-03  506          kfree(usb_path);
ef1547c12e0daf Łukasz Spintzyk 2020-12-03 @507          kfree(usb_token_copy);
                                                              ^^^^^^^^^^^^^^
Typical bug when trying to free things that weren't allocated yet.

014bcd16d12923 Łukasz Spintzyk 2020-12-03  508          return -EINVAL;
014bcd16d12923 Łukasz Spintzyk 2020-12-03  509  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]

Attachment: .config.gz
Description: application/gzip

_______________________________________________
kbuild mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to