drivers/uio/uio_pci_generic_sva.c:140 probe() warn: passing devm_ allocated variable to kfree. 'udev'
From: Dan Carpenter
Date: Sat Mar 21 2026 - 04:24:33 EST
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 42bddab0563fe67882b2722620a66dd98c8dbf33
commit: 3397c3cd859a2c51962ad032dcf97961d42f9db2 uio: Add SVA support for PCI devices via uio_pci_generic_sva.c
config: x86_64-randconfig-161-20260321 (https://download.01.org/0day-ci/archive/20260321/202603210811.1eXTfndx-lkp@xxxxxxxxx/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
smatch: v0.5.0-9004-gb810ac53
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
| Closes: https://lore.kernel.org/r/202603210811.1eXTfndx-lkp@xxxxxxxxx/
New smatch warnings:
drivers/uio/uio_pci_generic_sva.c:140 probe() warn: passing devm_ allocated variable to kfree. 'udev'
vim +/udev +140 drivers/uio/uio_pci_generic_sva.c
3397c3cd859a2c Yaxing Guo 2025-09-26 62 static int probe(struct pci_dev *pdev, const struct pci_device_id *id)
3397c3cd859a2c Yaxing Guo 2025-09-26 63 {
3397c3cd859a2c Yaxing Guo 2025-09-26 64 struct uio_pci_sva_dev *udev;
3397c3cd859a2c Yaxing Guo 2025-09-26 65 int ret, i, irq = 0;
3397c3cd859a2c Yaxing Guo 2025-09-26 66
3397c3cd859a2c Yaxing Guo 2025-09-26 67 ret = pci_enable_device(pdev);
3397c3cd859a2c Yaxing Guo 2025-09-26 68 if (ret) {
3397c3cd859a2c Yaxing Guo 2025-09-26 69 dev_err(&pdev->dev, "pci_enable_device failed: %d\n", ret);
3397c3cd859a2c Yaxing Guo 2025-09-26 70 return ret;
3397c3cd859a2c Yaxing Guo 2025-09-26 71 }
3397c3cd859a2c Yaxing Guo 2025-09-26 72
3397c3cd859a2c Yaxing Guo 2025-09-26 73 ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
3397c3cd859a2c Yaxing Guo 2025-09-26 74 if (ret)
3397c3cd859a2c Yaxing Guo 2025-09-26 75 goto out_disable;
3397c3cd859a2c Yaxing Guo 2025-09-26 76
3397c3cd859a2c Yaxing Guo 2025-09-26 77 pci_set_master(pdev);
3397c3cd859a2c Yaxing Guo 2025-09-26 78
3397c3cd859a2c Yaxing Guo 2025-09-26 79 ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_MSIX | PCI_IRQ_MSI);
3397c3cd859a2c Yaxing Guo 2025-09-26 80 if (ret > 0) {
3397c3cd859a2c Yaxing Guo 2025-09-26 81 irq = pci_irq_vector(pdev, 0);
3397c3cd859a2c Yaxing Guo 2025-09-26 82 if (irq < 0) {
3397c3cd859a2c Yaxing Guo 2025-09-26 83 dev_err(&pdev->dev, "Failed to get MSI vector\n");
3397c3cd859a2c Yaxing Guo 2025-09-26 84 ret = irq;
3397c3cd859a2c Yaxing Guo 2025-09-26 85 goto out_disable;
3397c3cd859a2c Yaxing Guo 2025-09-26 86 }
3397c3cd859a2c Yaxing Guo 2025-09-26 87 } else
3397c3cd859a2c Yaxing Guo 2025-09-26 88 dev_warn(&pdev->dev,
3397c3cd859a2c Yaxing Guo 2025-09-26 89 "No IRQ vectors available (%d), using polling\n", ret);
3397c3cd859a2c Yaxing Guo 2025-09-26 90
3397c3cd859a2c Yaxing Guo 2025-09-26 91 udev = devm_kzalloc(&pdev->dev, sizeof(struct uio_pci_sva_dev),
3397c3cd859a2c Yaxing Guo 2025-09-26 92 GFP_KERNEL);
udev is devm_ memory.
3397c3cd859a2c Yaxing Guo 2025-09-26 93 if (!udev) {
3397c3cd859a2c Yaxing Guo 2025-09-26 94 ret = -ENOMEM;
3397c3cd859a2c Yaxing Guo 2025-09-26 95 goto out_disable;
3397c3cd859a2c Yaxing Guo 2025-09-26 96 }
3397c3cd859a2c Yaxing Guo 2025-09-26 97
[ snip ]
3397c3cd859a2c Yaxing Guo 2025-09-26 129 ret = devm_uio_register_device(&pdev->dev, &udev->info);
3397c3cd859a2c Yaxing Guo 2025-09-26 130 if (ret) {
3397c3cd859a2c Yaxing Guo 2025-09-26 131 dev_err(&pdev->dev, "Failed to register uio device\n");
3397c3cd859a2c Yaxing Guo 2025-09-26 132 goto out_free;
3397c3cd859a2c Yaxing Guo 2025-09-26 133 }
3397c3cd859a2c Yaxing Guo 2025-09-26 134
3397c3cd859a2c Yaxing Guo 2025-09-26 135 pci_set_drvdata(pdev, udev);
3397c3cd859a2c Yaxing Guo 2025-09-26 136
3397c3cd859a2c Yaxing Guo 2025-09-26 137 return 0;
3397c3cd859a2c Yaxing Guo 2025-09-26 138
3397c3cd859a2c Yaxing Guo 2025-09-26 139 out_free:
3397c3cd859a2c Yaxing Guo 2025-09-26 @140 kfree(udev);
So this is a double free.
3397c3cd859a2c Yaxing Guo 2025-09-26 141 out_disable:
3397c3cd859a2c Yaxing Guo 2025-09-26 142 pci_disable_device(pdev);
3397c3cd859a2c Yaxing Guo 2025-09-26 143
3397c3cd859a2c Yaxing Guo 2025-09-26 144 return ret;
3397c3cd859a2c Yaxing Guo 2025-09-26 145 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki