Hello Dawei Li,
Commit 2410558f5f11 ("rpmsg: char: Implement eptdev based on
anonymous inode") from Oct 15, 2025 (linux-next), leads to the
following Smatch static checker warning:
drivers/rpmsg/rpmsg_char.c:548 rpmsg_anonymous_eptdev_create()
error: dereferencing freed memory 'eptdev' (line 546)
drivers/rpmsg/rpmsg_char.c
538 /* Anonymous inode only supports these file flags */
539 if (flags & ~(O_ACCMODE | O_NONBLOCK | O_CLOEXEC))
540 return -EINVAL;
541
542 eptdev = rpmsg_eptdev_alloc(rpdev, parent, false);
543 if (IS_ERR(eptdev))
544 return PTR_ERR(eptdev);
545
546 ret = rpmsg_eptdev_add(eptdev, chinfo, false);
547 if (ret) {
--> 548 dev_err(&eptdev->dev, "failed to add %s\n",
eptdev->chinfo.name);
^^^^^^ ^^^^^^
The rpmsg_eptdev_add() function frees "eptdev" on error.
549 return ret;
550 }
551
552 fd = anon_inode_getfd("rpmsg-eptdev",
&rpmsg_anonymous_eptdev_fops, eptdev, flags);
553 if (fd < 0) {
554 put_device(&eptdev->dev);
555 return fd;
556 }
557
558 mutex_lock(&eptdev->ept_lock);
559 ret = __rpmsg_eptdev_open(eptdev);
Should we free eptdev if __rpmsg_eptdev_open() fails?
560 mutex_unlock(&eptdev->ept_lock);
561
562 if (!ret)
563 *pfd = fd;
564
565 return ret;
566 }
regards,
dan carpenter
