Hi Yoochan, Thank you for the patch! Yet something to improve: [auto build test ERROR on char-misc/char-misc-testing] [also build test ERROR on char-misc/char-misc-next char-misc/char-misc-linus soc/for-next linus/master v6.2-rc1 next-20221226] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Yoochan-Lee/misc-phantom-Fix-use-after-free-in-phantom_open/20221231-140519 patch link: https://lore.kernel.org/r/20221231060459.2041173-1-yoochan1026%40gmail.com patch subject: [PATCH] misc: phantom: Fix use-after-free in phantom_open config: x86_64-randconfig-a005-20221226 compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://github.com/intel-lab-lkp/linux/commit/350dcfa1ef8b394d79ef66c82a0ec66b813708ef git remote add linux-review https://github.com/intel-lab-lkp/linux git fetch --no-tags linux-review Yoochan-Lee/misc-phantom-Fix-use-after-free-in-phantom_open/20221231-140519 git checkout 350dcfa1ef8b394d79ef66c82a0ec66b813708ef # save the config file mkdir build_dir && cp config build_dir/.config COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=x86_64 olddefconfig COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash drivers/misc/ If you fix the issue, kindly add following tag where applicable | Reported-by: kernel test robot All error/warnings (new ones prefixed by >>): >> drivers/misc/phantom.c:86:53: error: use of undeclared identifier 'minor'; did you mean 'iminor'? device_destroy(phantom_class, MKDEV(phantom_major, minor)); ^~~~~ iminor include/linux/kdev_t.h:12:46: note: expanded from macro 'MKDEV' #define MKDEV(ma,mi) (((ma) << MINORBITS) | (mi)) ^ include/linux/fs.h:890:24: note: 'iminor' declared here static inline unsigned iminor(const struct inode *inode) ^ >> drivers/misc/phantom.c:86:32: error: invalid operands to binary expression ('int' and 'unsigned int (const struct inode *)') device_destroy(phantom_class, MKDEV(phantom_major, minor)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kdev_t.h:12:43: note: expanded from macro 'MKDEV' #define MKDEV(ma,mi) (((ma) << MINORBITS) | (mi)) ~~~~~~~~~~~~~~~~~~~ ^ ~~~~ >> drivers/misc/phantom.c:92:11: error: use of undeclared identifier 'pdev' free_irq(pdev->irq, pht); ^ drivers/misc/phantom.c:94:14: error: use of undeclared identifier 'pdev' pci_iounmap(pdev, pht->oaddr); ^ drivers/misc/phantom.c:95:14: error: use of undeclared identifier 'pdev' pci_iounmap(pdev, pht->iaddr); ^ drivers/misc/phantom.c:96:14: error: use of undeclared identifier 'pdev' pci_iounmap(pdev, pht->caddr); ^ drivers/misc/phantom.c:100:22: error: use of undeclared identifier 'pdev' pci_release_regions(pdev); ^ drivers/misc/phantom.c:102:18: error: use of undeclared identifier 'minor'; did you mean 'iminor'? phantom_devices[minor] = 0; ^~~~~ iminor include/linux/fs.h:890:24: note: 'iminor' declared here static inline unsigned iminor(const struct inode *inode) ^ >> drivers/misc/phantom.c:102:17: error: array subscript is not an integer phantom_devices[minor] = 0; ^~~~~~ drivers/misc/phantom.c:104:21: error: use of undeclared identifier 'pdev' pci_disable_device(pdev); ^ >> drivers/misc/phantom.c:467:15: warning: unused variable 'minor' [-Wunused-variable] unsigned int minor = MINOR(pht->cdev.dev); ^ 1 warning and 10 errors generated. vim +86 drivers/misc/phantom.c 81 82 static void phantom_delete(struct kref *kref) 83 { 84 struct phantom_device *pht = container_of(kref, struct phantom_device, refcnt); 85 > 86 device_destroy(phantom_class, MKDEV(phantom_major, minor)); 87 88 cdev_del(&pht->cdev); 89 90 iowrite32(0, pht->caddr + PHN_IRQCTL); 91 ioread32(pht->caddr + PHN_IRQCTL); /* PCI posting */ > 92 free_irq(pdev->irq, pht); 93 94 pci_iounmap(pdev, pht->oaddr); 95 pci_iounmap(pdev, pht->iaddr); 96 pci_iounmap(pdev, pht->caddr); 97 98 kfree(pht); 99 100 pci_release_regions(pdev); 101 > 102 phantom_devices[minor] = 0; 103 104 pci_disable_device(pdev); 105 -- 0-DAY CI Kernel Test Service https://01.org/lkp