Hi Thomas,

kernel test robot noticed the following build warnings:

https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    
https://github.com/intel-lab-lkp/linux/commits/Thomas-Hellstr-m/drm-ttm-Allow-TTM-LRU-list-nodes-of-different-types/20240614-182911
base:   https://gitlab.freedesktop.org/drm/xe/kernel.git drm-xe-next
patch link:    
https://lore.kernel.org/r/20240614102548.4364-9-thomas.hellstrom%40linux.intel.com
patch subject: [PATCH v4 08/12] drm/ttm: Add a virtual base class for graphics 
memory backup
config: x86_64-randconfig-161-20240617 
(https://download.01.org/0day-ci/archive/20240617/202406170559.wddkfeiu-...@intel.com/config)
compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <l...@intel.com>
| Reported-by: Dan Carpenter <dan.carpen...@linaro.org>
| Closes: https://lore.kernel.org/r/202406170559.wddkfeiu-...@intel.com/

smatch warnings:
drivers/gpu/drm/ttm/ttm_backup_shmem.c:130 ttm_backup_shmem_create() error: 
dereferencing freed memory 'sbackup'

vim +/sbackup +130 drivers/gpu/drm/ttm/ttm_backup_shmem.c

827540d42dec01 Thomas Hellström 2024-06-14  119  struct ttm_backup 
*ttm_backup_shmem_create(loff_t size)
827540d42dec01 Thomas Hellström 2024-06-14  120  {
827540d42dec01 Thomas Hellström 2024-06-14  121         struct ttm_backup_shmem 
*sbackup =
827540d42dec01 Thomas Hellström 2024-06-14  122                 
kzalloc(sizeof(*sbackup), GFP_KERNEL | __GFP_ACCOUNT);
827540d42dec01 Thomas Hellström 2024-06-14  123  
827540d42dec01 Thomas Hellström 2024-06-14  124         if (!sbackup)
827540d42dec01 Thomas Hellström 2024-06-14  125                 return 
ERR_PTR(-ENOMEM);
827540d42dec01 Thomas Hellström 2024-06-14  126  
827540d42dec01 Thomas Hellström 2024-06-14  127         sbackup->filp = 
shmem_file_setup("ttm shmem backup", size, 0);
827540d42dec01 Thomas Hellström 2024-06-14  128         if 
(IS_ERR(sbackup->filp)) {
827540d42dec01 Thomas Hellström 2024-06-14  129                 kfree(sbackup);
                                                                      ^^^^^^^
Freed

827540d42dec01 Thomas Hellström 2024-06-14 @130                 return 
ERR_CAST(sbackup->filp);
                                                                                
^^^^^^^^^^^^^
Use after free

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Reply via email to