Date:   Fri, 17 Dec 2021 10:49:01 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     kbuild@lists.01.org, Christoph Hellwig <hch@lst.de>
Cc:     lkp@intel.com, kbuild-all@lists.01.org,
        linux-kernel@vger.kernel.org, Jens Axboe <axboe@kernel.dk>,
        Jan Kara <jack@suse.cz>
Subject: [axboe-block:for-5.17/block 106/108] block/blk-ioc.c:307
 set_task_ioprio() error: we previously assumed 'task->io_context' could be
 null (see line 300)
Message-ID: <202112171520.5hNnOM0q-lkp@intel.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?9A/O/McC7At/537p+g1wa7KAbjI30mjkPrpjPfvduyucho5ORCOi2sqI45MC?=
 =?us-ascii?Q?UQhy8GzEk8MDb0C3yAvoJSjN1uSQgG5CR23Gdyaok5MPH0/0kST8ZaQhuPbW?=
 =?us-ascii?Q?oHfZEMvhZhEej0mHe1PqnLh9YeF68p24DVWD9OqSKi2uBvcLSQLS3fxyCpVZ?=
 =?us-ascii?Q?lr1adpIub/POhtUihVoaEuNgvXK79l/P1z/oRtDglPctU+9X9AKOWiXCoPKd?=
 =?us-ascii?Q?Xj5fUFBsib990VFfKVFtf4Y9qXLj+CzCzq5m1XJ/J77JtF8NqVQDmjbRltzF?=
 =?us-ascii?Q?X1F25xoUnpYLDxPuLCd++n7p/8I3jARVndzUGhujoXTthIfQub2Kb6Wyo+xA?=
 =?us-ascii?Q?JC5cgYSNoYLQ5VB4/84BuM0dnhJR/iZ52LrajG/spLV4CdeWTE/I8PvKmnIn?=
 =?us-ascii?Q?HddH6KDXIQPeNsdn6YBN+k2KFn4rHzw3nGe9XyOJw1NV4yHDH7M/Q+mVRtqA?=
 =?us-ascii?Q?av9PzQEkebWb/WwWx7K04YxPWjnK1Vi4NHN5UpEs0+/orFsy31IHFnzEeo2I?=
 =?us-ascii?Q?MFRHYbHcgtDPatcXZORdGOruzqON/419Hhwse628sq2S4AsSZ6MtVb9XBHBG?=
 =?us-ascii?Q?dT7KRerO1hSFIU9BBRbgKteV3tktincMKYkIHQKyhswRXI4EszjF6nZxtEoa?=
 =?us-ascii?Q?A2o8xq/SUQORn0ipB+CaSf9X33W1tXb5TBV6IVgd5FisQ/eqyLfy/N4z2gec?=
 =?us-ascii?Q?AmxGcCDrO4nCe7ZQOr8us97p8s3KeblZ1QFzyd4tlcsOhZs1So0DSIbc5MbA?=
 =?us-ascii?Q?e3HXwJPj59UjOBNWRuz/XHer36lTdER6Mm4p/h0KyO+KeFlXijyJGbHUmSZr?=
 =?us-ascii?Q?N9F4Ng2Bosbzt37qDEOHu5jE8jXT1YgFv053JpwA7mpJtcfXvQqBy+yFQmFa?=
 =?us-ascii?Q?HVYOAZxLYg5f3rnNHsz3+axLSCKgnN0lqE/nu5SlH8lJOSvJ4Cr7UoXEay5k?=
 =?us-ascii?Q?NO4iaHYjH/ORwp4o0jcWb6hI+OhUdfcc7UOq/X3nVrK8t17uvYgEKGw9Emd2?=
 =?us-ascii?Q?VMYvlPH/5/1Cun0yt3nuNiOsOYQ48XCtuvjSl0Tkd6XS+6lviYJx/4nmcv03?=
 =?us-ascii?Q?+pv7WwIU8B9eXZj1mRbTkKLw84AGYx3ahfMP+Z9TJCbVd5PaaO8cu9d1TnJx?=
 =?us-ascii?Q?IIz5zl+mI4quXvOI9HfFJtNkj1DAxHnMbliINzTSw/Y9aGAD7jQKPJUPwDw3?=
 =?us-ascii?Q?P8wHIeBrMpHwWOHG2nfoYQ3S/JDZrsAVCTrYHZVMqkdBADNhVF0aF5EtFcRz?=
 =?us-ascii?Q?pAUN8z08APHBwQjaVslebRvayaFRYS/Zbd/mQ/CAMd+2iKJrv9iWAq2fapKl?=
 =?us-ascii?Q?dD0RdwbK9vjMxd06366k5eLcKY7NomyuWLJuXCRGIRrkRMYg8j1Z34MkAM0o?=
 =?us-ascii?Q?Cp5wlugUERM0tdsDfKb0yP2nhSedwyxTy+hX6tbja/ryy6V8+o6LFJrrtrdf?=
 =?us-ascii?Q?IrvIwfBps0BeaYnGSpQOJbeURDU9in4bo6NY9vtYDWoIF7co2CYU+FBZPqVz?=
 =?us-ascii?Q?ZHzk+tmcDiPjLgrLRDmHkwyHIAgP3rcGMKuTAecgkNOsx50NrSr97bFipfx4?=
 =?us-ascii?Q?B/w6/eUHN17TeXN86C39RPe+UYDHEMfWa8FXtKkL0AJV4eUBGrzwGS/gfY6M?=
 =?us-ascii?Q?ZW1nKKCWb+0QCAYPEZquh2VCWGSRWcv42k52YBVSe3WWFcjf1djHHroCutno?=
 =?us-ascii?Q?i0SVLGjZXrvMRhGCGmqMwIeYpys=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5a72938d-93fb-4678-4b22-08d9c131bd56
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Dec 2021 07:49:22.7850
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 4dOPy3ICRfFFh0sT1IIg/lugpqulYWjTX2T1LpZMhozGL5VEv5ZIqIRxmrR2UBQGC68Jxy40wFazGTC95nQP3LR/vVRiu0WaP/dzHRFLrCA=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR10MB1774
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10200 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 spamscore=0 suspectscore=0
 malwarescore=0 mlxlogscore=999 bulkscore=0 mlxscore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2112170043
X-Proofpoint-ORIG-GUID: 2vw_POIgy3htMbvvEjs04hgB8HNiN56z
X-Proofpoint-GUID: 2vw_POIgy3htMbvvEjs04hgB8HNiN56z
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git for-5.17/block
head:   5ef1630586317e92c9ebd7b4ce48f393b7ff790f
commit: 5fc11eebb4a98df5324a4de369bb5ab7f0007ff7 [106/108] block: open code create_task_io_context in set_task_ioprio
config: i386-randconfig-m021-20211216 (https://download.01.org/0day-ci/archive/20211217/202112171520.5hNnOM0q-lkp@intel.com/config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

smatch warnings:
block/blk-ioc.c:307 set_task_ioprio() error: we previously assumed 'task->io_context' could be null (see line 300)

vim +307 block/blk-ioc.c

a411cd3cfdc5bb Christoph Hellwig 2021-12-09  271  int set_task_ioprio(struct task_struct *task, int ioprio)
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  272  {
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  273  	int err;
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  274  	const struct cred *cred = current_cred(), *tcred;
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  275  
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  276  	rcu_read_lock();
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  277  	tcred = __task_cred(task);
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  278  	if (!uid_eq(tcred->uid, cred->euid) &&
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  279  	    !uid_eq(tcred->uid, cred->uid) && !capable(CAP_SYS_NICE)) {
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  280  		rcu_read_unlock();
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  281  		return -EPERM;
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  282  	}
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  283  	rcu_read_unlock();
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  284  
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  285  	err = security_task_setioprio(task, ioprio);
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  286  	if (err)
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  287  		return err;
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  288  
8472161b77c41d Christoph Hellwig 2021-12-09  289  	task_lock(task);
8472161b77c41d Christoph Hellwig 2021-12-09  290  	if (unlikely(!task->io_context)) {
8472161b77c41d Christoph Hellwig 2021-12-09  291  		struct io_context *ioc;
8472161b77c41d Christoph Hellwig 2021-12-09  292  
8472161b77c41d Christoph Hellwig 2021-12-09  293  		task_unlock(task);
5fc11eebb4a98d Christoph Hellwig 2021-12-09  294  
5fc11eebb4a98d Christoph Hellwig 2021-12-09  295  		ioc = alloc_io_context(GFP_ATOMIC, NUMA_NO_NODE);
5fc11eebb4a98d Christoph Hellwig 2021-12-09  296  		if (!ioc)
5fc11eebb4a98d Christoph Hellwig 2021-12-09  297  			return -ENOMEM;
5fc11eebb4a98d Christoph Hellwig 2021-12-09  298  
5fc11eebb4a98d Christoph Hellwig 2021-12-09  299  		task_lock(task);
5fc11eebb4a98d Christoph Hellwig 2021-12-09 @300  		if (task->io_context || (task->flags & PF_EXITING)) {
                                                                                         ^^^^^^^^^^^^^^^^^^^^^^^^
Assume "task->io_context" is NULL but PF_EXITING is set.

5fc11eebb4a98d Christoph Hellwig 2021-12-09  301  			kmem_cache_free(iocontext_cachep, ioc);
5fc11eebb4a98d Christoph Hellwig 2021-12-09  302  			ioc = task->io_context;
5fc11eebb4a98d Christoph Hellwig 2021-12-09  303  		} else {
5fc11eebb4a98d Christoph Hellwig 2021-12-09  304  			task->io_context = ioc;
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  305  		}
8472161b77c41d Christoph Hellwig 2021-12-09  306  	}
8472161b77c41d Christoph Hellwig 2021-12-09 @307  	task->io_context->ioprio = ioprio;
                                                        ^^^^^^^^^^^^^^^^^^
Unchecked dereference.

8472161b77c41d Christoph Hellwig 2021-12-09  308  	task_unlock(task);
8472161b77c41d Christoph Hellwig 2021-12-09  309  	return 0;
a411cd3cfdc5bb Christoph Hellwig 2021-12-09  310  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org