Hi Yoochan, Thank you for the patch! Yet something to improve: [auto build test ERROR on soc/for-next] [also build test ERROR on char-misc/char-misc-testing char-misc/char-misc-next char-misc/char-misc-linus linus/master v6.2-rc1 next-20221226] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Yoochan-Lee/char-xilinx_hwicap-xilinx_hwicap-Fix-use-after-free-in-hwicap_open/20221231-112957 base: https://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git for-next patch link: https://lore.kernel.org/r/20221231032826.2034288-1-yoochan1026%40gmail.com patch subject: [PATCH] char: xilinx_hwicap: xilinx_hwicap: Fix use-after-free in hwicap_open config: microblaze-randconfig-r013-20221226 compiler: microblaze-linux-gcc (GCC) 12.1.0 reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://github.com/intel-lab-lkp/linux/commit/85568c4b21398a7da51b017dbbf78424b59f1f2f git remote add linux-review https://github.com/intel-lab-lkp/linux git fetch --no-tags linux-review Yoochan-Lee/char-xilinx_hwicap-xilinx_hwicap-Fix-use-after-free-in-hwicap_open/20221231-112957 git checkout 85568c4b21398a7da51b017dbbf78424b59f1f2f # save the config file mkdir build_dir && cp config build_dir/.config COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=microblaze olddefconfig COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=microblaze SHELL=/bin/bash If you fix the issue, kindly add following tag where applicable | Reported-by: kernel test robot All errors (new ones prefixed by >>): drivers/char/xilinx_hwicap/xilinx_hwicap.c: In function 'hwicap_release': >> drivers/char/xilinx_hwicap/xilinx_hwicap.c:587:36: error: 'hwicap_delete' undeclared (first use in this function); did you mean 'hwicap_release'? 587 | kref_put(&drvdata->refcnt, hwicap_delete); | ^~~~~~~~~~~~~ | hwicap_release drivers/char/xilinx_hwicap/xilinx_hwicap.c:587:36: note: each undeclared identifier is reported only once for each function it appears in drivers/char/xilinx_hwicap/xilinx_hwicap.c: In function 'hwicap_remove': drivers/char/xilinx_hwicap/xilinx_hwicap.c:736:36: error: 'hwicap_delete' undeclared (first use in this function); did you mean 'hwicap_release'? 736 | kref_put(&drvdata->refcnt, hwicap_delete); | ^~~~~~~~~~~~~ | hwicap_release In file included from include/linux/fs.h:7, from include/linux/huge_mm.h:8, from include/linux/mm.h:737, from arch/microblaze/include/asm/io.h:14, from include/linux/io.h:13, from include/linux/irq.h:20, from include/asm-generic/hardirq.h:17, from ./arch/microblaze/include/generated/asm/hardirq.h:1, from include/linux/hardirq.h:11, from include/linux/interrupt.h:11, from drivers/char/xilinx_hwicap/xilinx_hwicap.c:78: drivers/char/xilinx_hwicap/xilinx_hwicap.c: In function 'hwicap_delete': >> drivers/char/xilinx_hwicap/xilinx_hwicap.c:840:30: error: 'dev' undeclared (first use in this function); did you mean 'cdev'? 840 | probed_devices[MINOR(dev->devt)-XHWICAP_MINOR] = 0; | ^~~ include/linux/kdev_t.h:11:43: note: in definition of macro 'MINOR' 11 | #define MINOR(dev) ((unsigned int) ((dev) & MINORMASK)) | ^~~ drivers/char/xilinx_hwicap/xilinx_hwicap.c: At top level: drivers/char/xilinx_hwicap/xilinx_hwicap.c:829:13: warning: 'hwicap_delete' defined but not used [-Wunused-function] 829 | static void hwicap_delete(struct kref *kref) | ^~~~~~~~~~~~~ vim +587 drivers/char/xilinx_hwicap/xilinx_hwicap.c 564 565 static int hwicap_release(struct inode *inode, struct file *file) 566 { 567 struct hwicap_drvdata *drvdata = file->private_data; 568 int i; 569 int status = 0; 570 571 mutex_lock(&drvdata->sem); 572 573 if (drvdata->write_buffer_in_use) { 574 /* Flush write buffer. */ 575 for (i = drvdata->write_buffer_in_use; i < 4; i++) 576 drvdata->write_buffer[i] = 0; 577 578 status = drvdata->config->set_configuration(drvdata, 579 (u32 *) drvdata->write_buffer, 1); 580 if (status) 581 goto error; 582 } 583 584 status = hwicap_command_desync(drvdata); 585 if (status) 586 goto error; > 587 kref_put(&drvdata->refcnt, hwicap_delete); 588 589 error: 590 drvdata->is_open = 0; 591 mutex_unlock(&drvdata->sem); 592 return status; 593 } 594 -- 0-DAY CI Kernel Test Service https://01.org/lkp