Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:2 as permitted sender) client-ip=2620:137:e000::3:2;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.200.91.1.1\))
Subject: Re: drivers/md/bcache/btree.c:1511 btree_gc_rewrite_node() error: 'n'
 dereferencing possible ERR_PTR()
From:   Coly Li <colyli@suse.de>
In-Reply-To: <a754f8a3-cbfb-42bb-b776-94ecac062daf@kadam.mountain>
Date:   Tue, 7 Nov 2023 14:34:38 +0800
Cc:     oe-kbuild@lists.linux.dev, Zheng Wang <zyytlz.wz@163.com>,
        lkp@intel.com, oe-kbuild-all@lists.linux.dev,
        linux-kernel@vger.kernel.org, Jens Axboe <axboe@kernel.dk>
Content-Transfer-Encoding: quoted-printable
Message-Id: <6AAB7139-DE98-49BC-9DF9-F1819A39795E@suse.de>
References: <a754f8a3-cbfb-42bb-b776-94ecac062daf@kadam.mountain>
To:     Dan Carpenter <dan.carpenter@linaro.org>
Precedence: bulk


> 2023=E5=B9=B411=E6=9C=886=E6=97=A5 17:11=EF=BC=8CDan Carpenter =
<dan.carpenter@linaro.org> =E5=86=99=E9=81=93=EF=BC=9A
>=20
> Hi Zheng,
>=20
> FYI, the error/warning was bisected to this commit, please ignore it =
if it's irrelevant.
>=20
> tree:   =
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git =
master
> head:   77fa2fbe87fc605c4bfa87dff87be9bfded0e9a3
> commit: 028ddcac477b691dd9205c92f991cc15259d033e bcache: Remove =
unnecessary NULL point check in node allocations
> config: x86_64-randconfig-161-20231102 =
(https://download.01.org/0day-ci/archive/20231106/202311060857.2jHVe0uk-lk=
p@intel.com/config)
> compiler: gcc-7 (Ubuntu 7.5.0-6ubuntu2) 7.5.0
> reproduce: =
(https://download.01.org/0day-ci/archive/20231106/202311060857.2jHVe0uk-lk=
p@intel.com/reproduce)
>=20
> If you fix the issue in a separate patch/commit (i.e. not just a new =
version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> | Closes: =
https://lore.kernel.org/r/202311060857.2jHVe0uk-lkp@intel.com/
>=20
> New smatch warnings:
> drivers/md/bcache/btree.c:1511 btree_gc_rewrite_node() error: 'n' =
dereferencing possible ERR_PTR()
>=20
> Old smatch warnings:
> drivers/md/bcache/btree.c:1527 btree_gc_rewrite_node() error: 'n' =
dereferencing possible ERR_PTR()
>=20
> vim +/n +1511 drivers/md/bcache/btree.c
>=20
> 0a63b66db566cf Kent Overstreet 2014-03-17  1497  static int =
btree_gc_rewrite_node(struct btree *b, struct btree_op *op,
> 0a63b66db566cf Kent Overstreet 2014-03-17  1498   struct btree =
*replace)
> 0a63b66db566cf Kent Overstreet 2014-03-17  1499  {
> 0a63b66db566cf Kent Overstreet 2014-03-17  1500   struct keylist keys;
> 0a63b66db566cf Kent Overstreet 2014-03-17  1501   struct btree *n;
> 0a63b66db566cf Kent Overstreet 2014-03-17  1502 =20
> 0a63b66db566cf Kent Overstreet 2014-03-17  1503   if =
(btree_check_reserve(b, NULL))
> 0a63b66db566cf Kent Overstreet 2014-03-17  1504   return 0;
> 0a63b66db566cf Kent Overstreet 2014-03-17  1505 =20
> 0a63b66db566cf Kent Overstreet 2014-03-17  1506   n =3D =
btree_node_alloc_replacement(replace, NULL);
>=20
> Needs some error handling.  I don't know why the zero day bot is
> sending repeat warnings today but this one is still worth fixing.
> I guess the zero day bot sent the previous warning to the wrong people
> last time.

Yes this is a valid report. I feel checking n after =
btree_node_alloc_replacement() is necessary, and recent change from =
Zheng exported this potential issue to static code checking tool.

Since Zheng doesn=E2=80=99t respond yet, I will post a patch to fix the =
potential issue.

Thanks.


Coly Li


>=20
> =
https://lore.kernel.org/all/bab6966d-3f96-44a0-b666-ddf976179eab@kadam.mou=
ntain/
>=20
> 0a63b66db566cf Kent Overstreet 2014-03-17  1507 =20
> 0a63b66db566cf Kent Overstreet 2014-03-17  1508   /* recheck reserve =
after allocating replacement node */
> 0a63b66db566cf Kent Overstreet 2014-03-17  1509   if =
(btree_check_reserve(b, NULL)) {
> 0a63b66db566cf Kent Overstreet 2014-03-17  1510   btree_node_free(n);
> 0a63b66db566cf Kent Overstreet 2014-03-17 @1511   rw_unlock(true, n);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1512   return 0;
> 0a63b66db566cf Kent Overstreet 2014-03-17  1513   }
> 0a63b66db566cf Kent Overstreet 2014-03-17  1514 =20
> 0a63b66db566cf Kent Overstreet 2014-03-17  1515   =
bch_btree_node_write_sync(n);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1516 =20
> 0a63b66db566cf Kent Overstreet 2014-03-17  1517   =
bch_keylist_init(&keys);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1518   =
bch_keylist_add(&keys, &n->key);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1519 =20
> 0a63b66db566cf Kent Overstreet 2014-03-17  1520   =
make_btree_freeing_key(replace, keys.top);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1521   =
bch_keylist_push(&keys);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1522 =20
> 0a63b66db566cf Kent Overstreet 2014-03-17  1523   =
bch_btree_insert_node(b, op, &keys, NULL, NULL);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1524   =
BUG_ON(!bch_keylist_empty(&keys));
> 0a63b66db566cf Kent Overstreet 2014-03-17  1525 =20
> 0a63b66db566cf Kent Overstreet 2014-03-17  1526   =
btree_node_free(replace);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1527   rw_unlock(true, n);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1528 =20
> 0a63b66db566cf Kent Overstreet 2014-03-17  1529   /* Invalidated our =
iterator */
> 0a63b66db566cf Kent Overstreet 2014-03-17  1530   return -EINTR;
> 0a63b66db566cf Kent Overstreet 2014-03-17  1531  }
>=20
> --=20
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki
>=20