Hi Weitao,
kernel test robot noticed the following build warnings:
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Weitao-Wang/usb-xhci-Fix-slot... base: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing patch link: https://lore.kernel.org/r/20250730152715.8368-1-WeitaoWang-oc%40zhaoxin.com patch subject: [PATCH v3] usb:xhci:Fix slot_id resource race conflict config: x86_64-randconfig-161-20250801 (https://download.01.org/0day-ci/archive/20250801/202508010850.Bqd6wf47-lkp@i...) compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot lkp@intel.com | Reported-by: Dan Carpenter dan.carpenter@linaro.org | Closes: https://lore.kernel.org/r/202508010850.Bqd6wf47-lkp@intel.com/
New smatch warnings: drivers/usb/host/xhci-mem.c:913 xhci_free_virt_device() warn: variable dereferenced before check 'dev->out_ctx' (see line 878)
vim +913 drivers/usb/host/xhci-mem.c
0b5ed80150eb59 Weitao Wang 2025-07-30 868 void xhci_free_virt_device(struct xhci_hcd *xhci, struct xhci_virt_device *dev, 0b5ed80150eb59 Weitao Wang 2025-07-30 869 int slot_id) 3ffbba9511b414 Sarah Sharp 2009-04-27 870 { 3ffbba9511b414 Sarah Sharp 2009-04-27 871 int i; 2e27980e6eb781 Sarah Sharp 2011-09-02 872 int old_active_eps = 0; 3ffbba9511b414 Sarah Sharp 2009-04-27 873 3ffbba9511b414 Sarah Sharp 2009-04-27 874 /* Slot ID 0 is reserved */ 0b5ed80150eb59 Weitao Wang 2025-07-30 875 if (slot_id == 0 || !dev) 3ffbba9511b414 Sarah Sharp 2009-04-27 876 return; 3ffbba9511b414 Sarah Sharp 2009-04-27 877 0b5ed80150eb59 Weitao Wang 2025-07-30 @878 if (xhci->dcbaa->dev_context_ptrs[slot_id] == cpu_to_le64(dev->out_ctx->dma)) ^^^^^^^^^^^^ dev->out_ctx dereferenced without checking for NULL
8e595a5d30a5ee Sarah Sharp 2009-07-27 879 xhci->dcbaa->dev_context_ptrs[slot_id] = 0; 3ffbba9511b414 Sarah Sharp 2009-04-27 880 d850c1658328e7 Zhengjun Xing 2018-06-21 881 trace_xhci_free_virt_device(dev); d850c1658328e7 Zhengjun Xing 2018-06-21 882 2e27980e6eb781 Sarah Sharp 2011-09-02 883 if (dev->tt_info) 2e27980e6eb781 Sarah Sharp 2011-09-02 884 old_active_eps = dev->tt_info->active_eps; 2e27980e6eb781 Sarah Sharp 2011-09-02 885 98871e9470a50c Felipe Balbi 2017-01-23 886 for (i = 0; i < 31; i++) { 63a0d9abd18cdc Sarah Sharp 2009-09-04 887 if (dev->eps[i].ring) 63a0d9abd18cdc Sarah Sharp 2009-09-04 888 xhci_ring_free(xhci, dev->eps[i].ring); 8df75f42f8e67e Sarah Sharp 2010-04-02 889 if (dev->eps[i].stream_info) 8df75f42f8e67e Sarah Sharp 2010-04-02 890 xhci_free_stream_info(xhci, 8df75f42f8e67e Sarah Sharp 2010-04-02 891 dev->eps[i].stream_info); 5aed5b7c2430ce Mathias Nyman 2022-10-24 892 /* 5aed5b7c2430ce Mathias Nyman 2022-10-24 893 * Endpoints are normally deleted from the bandwidth list when 5aed5b7c2430ce Mathias Nyman 2022-10-24 894 * endpoints are dropped, before device is freed. 5aed5b7c2430ce Mathias Nyman 2022-10-24 895 * If host is dying or being removed then endpoints aren't 5aed5b7c2430ce Mathias Nyman 2022-10-24 896 * dropped cleanly, so delete the endpoint from list here. 5aed5b7c2430ce Mathias Nyman 2022-10-24 897 * Only applicable for hosts with software bandwidth checking. 2e27980e6eb781 Sarah Sharp 2011-09-02 898 */ 5aed5b7c2430ce Mathias Nyman 2022-10-24 899 5aed5b7c2430ce Mathias Nyman 2022-10-24 900 if (!list_empty(&dev->eps[i].bw_endpoint_list)) { 5aed5b7c2430ce Mathias Nyman 2022-10-24 901 list_del_init(&dev->eps[i].bw_endpoint_list); 5aed5b7c2430ce Mathias Nyman 2022-10-24 902 xhci_dbg(xhci, "Slot %u endpoint %u not removed from BW list!\n", 2e27980e6eb781 Sarah Sharp 2011-09-02 903 slot_id, i); 8df75f42f8e67e Sarah Sharp 2010-04-02 904 } 5aed5b7c2430ce Mathias Nyman 2022-10-24 905 } 839c817ce67178 Sarah Sharp 2011-09-02 906 /* If this is a hub, free the TT(s) from the TT list */ 839c817ce67178 Sarah Sharp 2011-09-02 907 xhci_free_tt_info(xhci, dev, slot_id); 2e27980e6eb781 Sarah Sharp 2011-09-02 908 /* If necessary, update the number of active TTs on this root port */ 2e27980e6eb781 Sarah Sharp 2011-09-02 909 xhci_update_tt_active_eps(xhci, dev, old_active_eps); 3ffbba9511b414 Sarah Sharp 2009-04-27 910 3ffbba9511b414 Sarah Sharp 2009-04-27 911 if (dev->in_ctx) d115b04818e57b John Youn 2009-07-27 912 xhci_free_container_ctx(xhci, dev->in_ctx); 3ffbba9511b414 Sarah Sharp 2009-04-27 @913 if (dev->out_ctx) ^^^^^^^^^^^^ Can dev->out_ctx be NULL?
d115b04818e57b John Youn 2009-07-27 914 xhci_free_container_ctx(xhci, dev->out_ctx); d115b04818e57b John Youn 2009-07-27 915 a400efe455f7b6 Mathias Nyman 2018-03-16 916 if (dev->udev && dev->udev->slot_id) a400efe455f7b6 Mathias Nyman 2018-03-16 917 dev->udev->slot_id = 0; 74151b5349266b Niklas Neronin 2024-02-29 918 if (dev->rhub_port && dev->rhub_port->slot_id == slot_id) 74151b5349266b Niklas Neronin 2024-02-29 919 dev->rhub_port->slot_id = 0; 0b5ed80150eb59 Weitao Wang 2025-07-30 920 if (xhci->devs[slot_id] == dev) 326b4810cc9952 Randy Dunlap 2010-04-19 921 xhci->devs[slot_id] = NULL; 0b5ed80150eb59 Weitao Wang 2025-07-30 922 kfree(dev); 3ffbba9511b414 Sarah Sharp 2009-04-27 923 }