2023-11-06 09:11:34

by Dan Carpenter

[permalink] [raw]
Subject: drivers/md/bcache/btree.c:1511 btree_gc_rewrite_node() error: 'n' dereferencing possible ERR_PTR()

Hi Zheng,

FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant.

tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 77fa2fbe87fc605c4bfa87dff87be9bfded0e9a3
commit: 028ddcac477b691dd9205c92f991cc15259d033e bcache: Remove unnecessary NULL point check in node allocations
config: x86_64-randconfig-161-20231102 (https://download.01.org/0day-ci/archive/20231106/[email protected]/config)
compiler: gcc-7 (Ubuntu 7.5.0-6ubuntu2) 7.5.0
reproduce: (https://download.01.org/0day-ci/archive/20231106/[email protected]/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

New smatch warnings:
drivers/md/bcache/btree.c:1511 btree_gc_rewrite_node() error: 'n' dereferencing possible ERR_PTR()

Old smatch warnings:
drivers/md/bcache/btree.c:1527 btree_gc_rewrite_node() error: 'n' dereferencing possible ERR_PTR()

vim +/n +1511 drivers/md/bcache/btree.c

0a63b66db566cf Kent Overstreet 2014-03-17 1497 static int btree_gc_rewrite_node(struct btree *b, struct btree_op *op,
0a63b66db566cf Kent Overstreet 2014-03-17 1498 struct btree *replace)
0a63b66db566cf Kent Overstreet 2014-03-17 1499 {
0a63b66db566cf Kent Overstreet 2014-03-17 1500 struct keylist keys;
0a63b66db566cf Kent Overstreet 2014-03-17 1501 struct btree *n;
0a63b66db566cf Kent Overstreet 2014-03-17 1502
0a63b66db566cf Kent Overstreet 2014-03-17 1503 if (btree_check_reserve(b, NULL))
0a63b66db566cf Kent Overstreet 2014-03-17 1504 return 0;
0a63b66db566cf Kent Overstreet 2014-03-17 1505
0a63b66db566cf Kent Overstreet 2014-03-17 1506 n = btree_node_alloc_replacement(replace, NULL);

Needs some error handling. I don't know why the zero day bot is
sending repeat warnings today but this one is still worth fixing.
I guess the zero day bot sent the previous warning to the wrong people
last time.

https://lore.kernel.org/all/[email protected]/

0a63b66db566cf Kent Overstreet 2014-03-17 1507
0a63b66db566cf Kent Overstreet 2014-03-17 1508 /* recheck reserve after allocating replacement node */
0a63b66db566cf Kent Overstreet 2014-03-17 1509 if (btree_check_reserve(b, NULL)) {
0a63b66db566cf Kent Overstreet 2014-03-17 1510 btree_node_free(n);
0a63b66db566cf Kent Overstreet 2014-03-17 @1511 rw_unlock(true, n);
0a63b66db566cf Kent Overstreet 2014-03-17 1512 return 0;
0a63b66db566cf Kent Overstreet 2014-03-17 1513 }
0a63b66db566cf Kent Overstreet 2014-03-17 1514
0a63b66db566cf Kent Overstreet 2014-03-17 1515 bch_btree_node_write_sync(n);
0a63b66db566cf Kent Overstreet 2014-03-17 1516
0a63b66db566cf Kent Overstreet 2014-03-17 1517 bch_keylist_init(&keys);
0a63b66db566cf Kent Overstreet 2014-03-17 1518 bch_keylist_add(&keys, &n->key);
0a63b66db566cf Kent Overstreet 2014-03-17 1519
0a63b66db566cf Kent Overstreet 2014-03-17 1520 make_btree_freeing_key(replace, keys.top);
0a63b66db566cf Kent Overstreet 2014-03-17 1521 bch_keylist_push(&keys);
0a63b66db566cf Kent Overstreet 2014-03-17 1522
0a63b66db566cf Kent Overstreet 2014-03-17 1523 bch_btree_insert_node(b, op, &keys, NULL, NULL);
0a63b66db566cf Kent Overstreet 2014-03-17 1524 BUG_ON(!bch_keylist_empty(&keys));
0a63b66db566cf Kent Overstreet 2014-03-17 1525
0a63b66db566cf Kent Overstreet 2014-03-17 1526 btree_node_free(replace);
0a63b66db566cf Kent Overstreet 2014-03-17 1527 rw_unlock(true, n);
0a63b66db566cf Kent Overstreet 2014-03-17 1528
0a63b66db566cf Kent Overstreet 2014-03-17 1529 /* Invalidated our iterator */
0a63b66db566cf Kent Overstreet 2014-03-17 1530 return -EINTR;
0a63b66db566cf Kent Overstreet 2014-03-17 1531 }

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki


2023-11-07 06:35:17

by Coly Li

[permalink] [raw]
Subject: Re: drivers/md/bcache/btree.c:1511 btree_gc_rewrite_node() error: 'n' dereferencing possible ERR_PTR()



> 2023年11月6日 17:11,Dan Carpenter <[email protected]> 写道:
>
> Hi Zheng,
>
> FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant.
>
> tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> head: 77fa2fbe87fc605c4bfa87dff87be9bfded0e9a3
> commit: 028ddcac477b691dd9205c92f991cc15259d033e bcache: Remove unnecessary NULL point check in node allocations
> config: x86_64-randconfig-161-20231102 (https://download.01.org/0day-ci/archive/20231106/[email protected]/config)
> compiler: gcc-7 (Ubuntu 7.5.0-6ubuntu2) 7.5.0
> reproduce: (https://download.01.org/0day-ci/archive/20231106/[email protected]/reproduce)
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <[email protected]>
> | Reported-by: Dan Carpenter <[email protected]>
> | Closes: https://lore.kernel.org/r/[email protected]/
>
> New smatch warnings:
> drivers/md/bcache/btree.c:1511 btree_gc_rewrite_node() error: 'n' dereferencing possible ERR_PTR()
>
> Old smatch warnings:
> drivers/md/bcache/btree.c:1527 btree_gc_rewrite_node() error: 'n' dereferencing possible ERR_PTR()
>
> vim +/n +1511 drivers/md/bcache/btree.c
>
> 0a63b66db566cf Kent Overstreet 2014-03-17 1497 static int btree_gc_rewrite_node(struct btree *b, struct btree_op *op,
> 0a63b66db566cf Kent Overstreet 2014-03-17 1498 struct btree *replace)
> 0a63b66db566cf Kent Overstreet 2014-03-17 1499 {
> 0a63b66db566cf Kent Overstreet 2014-03-17 1500 struct keylist keys;
> 0a63b66db566cf Kent Overstreet 2014-03-17 1501 struct btree *n;
> 0a63b66db566cf Kent Overstreet 2014-03-17 1502
> 0a63b66db566cf Kent Overstreet 2014-03-17 1503 if (btree_check_reserve(b, NULL))
> 0a63b66db566cf Kent Overstreet 2014-03-17 1504 return 0;
> 0a63b66db566cf Kent Overstreet 2014-03-17 1505
> 0a63b66db566cf Kent Overstreet 2014-03-17 1506 n = btree_node_alloc_replacement(replace, NULL);
>
> Needs some error handling. I don't know why the zero day bot is
> sending repeat warnings today but this one is still worth fixing.
> I guess the zero day bot sent the previous warning to the wrong people
> last time.

Yes this is a valid report. I feel checking n after btree_node_alloc_replacement() is necessary, and recent change from Zheng exported this potential issue to static code checking tool.

Since Zheng doesn’t respond yet, I will post a patch to fix the potential issue.

Thanks.


Coly Li


>
> https://lore.kernel.org/all/[email protected]/
>
> 0a63b66db566cf Kent Overstreet 2014-03-17 1507
> 0a63b66db566cf Kent Overstreet 2014-03-17 1508 /* recheck reserve after allocating replacement node */
> 0a63b66db566cf Kent Overstreet 2014-03-17 1509 if (btree_check_reserve(b, NULL)) {
> 0a63b66db566cf Kent Overstreet 2014-03-17 1510 btree_node_free(n);
> 0a63b66db566cf Kent Overstreet 2014-03-17 @1511 rw_unlock(true, n);
> 0a63b66db566cf Kent Overstreet 2014-03-17 1512 return 0;
> 0a63b66db566cf Kent Overstreet 2014-03-17 1513 }
> 0a63b66db566cf Kent Overstreet 2014-03-17 1514
> 0a63b66db566cf Kent Overstreet 2014-03-17 1515 bch_btree_node_write_sync(n);
> 0a63b66db566cf Kent Overstreet 2014-03-17 1516
> 0a63b66db566cf Kent Overstreet 2014-03-17 1517 bch_keylist_init(&keys);
> 0a63b66db566cf Kent Overstreet 2014-03-17 1518 bch_keylist_add(&keys, &n->key);
> 0a63b66db566cf Kent Overstreet 2014-03-17 1519
> 0a63b66db566cf Kent Overstreet 2014-03-17 1520 make_btree_freeing_key(replace, keys.top);
> 0a63b66db566cf Kent Overstreet 2014-03-17 1521 bch_keylist_push(&keys);
> 0a63b66db566cf Kent Overstreet 2014-03-17 1522
> 0a63b66db566cf Kent Overstreet 2014-03-17 1523 bch_btree_insert_node(b, op, &keys, NULL, NULL);
> 0a63b66db566cf Kent Overstreet 2014-03-17 1524 BUG_ON(!bch_keylist_empty(&keys));
> 0a63b66db566cf Kent Overstreet 2014-03-17 1525
> 0a63b66db566cf Kent Overstreet 2014-03-17 1526 btree_node_free(replace);
> 0a63b66db566cf Kent Overstreet 2014-03-17 1527 rw_unlock(true, n);
> 0a63b66db566cf Kent Overstreet 2014-03-17 1528
> 0a63b66db566cf Kent Overstreet 2014-03-17 1529 /* Invalidated our iterator */
> 0a63b66db566cf Kent Overstreet 2014-03-17 1530 return -EINTR;
> 0a63b66db566cf Kent Overstreet 2014-03-17 1531 }
>
> --
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki
>