drivers/net/ethernet/microchip/sparx5/sparx5_packet.c:147 sparx5_xtr_grp() error: dereferencing freed memory 'skb'

[Dan Carpenter]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   26291c54e111ff6ba87a164d85d4a4e134b7315c
commit: f3cad2611a77f0229dc16aa7bd2ef63e35ea9fb6 net: sparx5: add hostmode with phylink support
config: nios2-randconfig-m031-20220130 (https://download.01.org/0day-ci/archive/20220201/202202011757.Azj3HHCb-lkp@xxxxxxxxx/config)
compiler: nios2-linux-gcc (GCC) 11.2.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@xxxxxxxxx>
Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>

smatch warnings:
drivers/net/ethernet/microchip/sparx5/sparx5_packet.c:147 sparx5_xtr_grp() error: dereferencing freed memory 'skb'

vim +/skb +147 drivers/net/ethernet/microchip/sparx5/sparx5_packet.c

f3cad2611a77f0 Steen Hegelund 2021-06-24  134  	if (abort_flag || pruned_flag || !eof_flag) {
f3cad2611a77f0 Steen Hegelund 2021-06-24  135  		netdev_err(netdev, "Discarded frame: abort:%d pruned:%d eof:%d\n",
f3cad2611a77f0 Steen Hegelund 2021-06-24  136  			   abort_flag, pruned_flag, eof_flag);
f3cad2611a77f0 Steen Hegelund 2021-06-24  137  		kfree_skb(skb);
f3cad2611a77f0 Steen Hegelund 2021-06-24  138  		netdev->stats.rx_dropped++;
f3cad2611a77f0 Steen Hegelund 2021-06-24  139  		return;
f3cad2611a77f0 Steen Hegelund 2021-06-24  140  	}
f3cad2611a77f0 Steen Hegelund 2021-06-24  141  
f3cad2611a77f0 Steen Hegelund 2021-06-24  142  	/* Finish up skb */
f3cad2611a77f0 Steen Hegelund 2021-06-24  143  	skb_put(skb, byte_cnt - ETH_FCS_LEN);
f3cad2611a77f0 Steen Hegelund 2021-06-24  144  	eth_skb_pad(skb);
f3cad2611a77f0 Steen Hegelund 2021-06-24  145  	skb->protocol = eth_type_trans(skb, netdev);
f3cad2611a77f0 Steen Hegelund 2021-06-24  146  	netif_rx(skb);
f3cad2611a77f0 Steen Hegelund 2021-06-24 @147  	netdev->stats.rx_bytes += skb->len;
                                                                          ^^^^^^^^
The netif_rx() function will free the skb.

f3cad2611a77f0 Steen Hegelund 2021-06-24  148  	netdev->stats.rx_packets++;
f3cad2611a77f0 Steen Hegelund 2021-06-24  149  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@xxxxxxxxxxxx