Received-SPF: pass (google.com: domain of linux-kernel+bounces-159152-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Fri, 26 Apr 2024 04:42:51 +0800
From: kernel test robot <lkp@intel.com>
To: Gavin Shan <gshan@redhat.com>, virtualization@lists.linux.dev
Cc: oe-kbuild-all@lists.linux.dev, linux-kernel@vger.kernel.org,
	mst@redhat.com, jasowang@redhat.com, shan.gavin@gmail.com
Subject: Re: [PATCH 3/4] vhost: Improve vhost_get_avail_head()
Message-ID: <202404260448.g7F06v7M-lkp@intel.com>
References: <20240423032407.262329-4-gshan@redhat.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240423032407.262329-4-gshan@redhat.com>

Hi Gavin,

kernel test robot noticed the following build warnings:

[auto build test WARNING on mst-vhost/linux-next]
[also build test WARNING on linus/master v6.9-rc5 next-20240424]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Gavin-Shan/vhost-Drop-variable-last_avail_idx-in-vhost_get_vq_desc/20240423-112803
base:   https://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git linux-next
patch link:    https://lore.kernel.org/r/20240423032407.262329-4-gshan%40redhat.com
patch subject: [PATCH 3/4] vhost: Improve vhost_get_avail_head()
config: i386-randconfig-141-20240426 (https://download.01.org/0day-ci/archive/20240426/202404260448.g7F06v7M-lkp@intel.com/config)
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202404260448.g7F06v7M-lkp@intel.com/

smatch warnings:
drivers/vhost/vhost.c:2614 vhost_get_vq_desc() warn: unsigned 'head' is never less than zero.
drivers/vhost/vhost.c:2614 vhost_get_vq_desc() warn: error code type promoted to positive: 'head'

vim +/head +2614 drivers/vhost/vhost.c

  2581	
  2582	/* This looks in the virtqueue and for the first available buffer, and converts
  2583	 * it to an iovec for convenient access.  Since descriptors consist of some
  2584	 * number of output then some number of input descriptors, it's actually two
  2585	 * iovecs, but we pack them into one and note how many of each there were.
  2586	 *
  2587	 * This function returns the descriptor number found, or vq->num (which is
  2588	 * never a valid descriptor number) if none was found.  A negative code is
  2589	 * returned on error. */
  2590	int vhost_get_vq_desc(struct vhost_virtqueue *vq,
  2591			      struct iovec iov[], unsigned int iov_size,
  2592			      unsigned int *out_num, unsigned int *in_num,
  2593			      struct vhost_log *log, unsigned int *log_num)
  2594	{
  2595		struct vring_desc desc;
  2596		unsigned int i, head, found = 0;
  2597		int ret, access;
  2598	
  2599		if (vq->avail_idx == vq->last_avail_idx) {
  2600			ret = vhost_get_avail_idx(vq);
  2601			if (unlikely(ret))
  2602				return ret;
  2603	
  2604			/* If there's nothing new since last we looked, return
  2605			 * invalid.
  2606			 */
  2607			if (vq->avail_idx == vq->last_avail_idx)
  2608				return vq->num;
  2609		}
  2610	
  2611		/* Grab the next descriptor number they're advertising, and increment
  2612		 * the index we've seen. */
  2613		head = vhost_get_avail_head(vq);
> 2614		if (unlikely(head < 0))
  2615			return head;
  2616	
  2617		/* When we start there are none of either input nor output. */
  2618		*out_num = *in_num = 0;
  2619		if (unlikely(log))
  2620			*log_num = 0;
  2621	
  2622		i = head;
  2623		do {
  2624			unsigned iov_count = *in_num + *out_num;
  2625			if (unlikely(i >= vq->num)) {
  2626				vq_err(vq, "Desc index is %u > %u, head = %u",
  2627				       i, vq->num, head);
  2628				return -EINVAL;
  2629			}
  2630			if (unlikely(++found > vq->num)) {
  2631				vq_err(vq, "Loop detected: last one at %u "
  2632				       "vq size %u head %u\n",
  2633				       i, vq->num, head);
  2634				return -EINVAL;
  2635			}
  2636			ret = vhost_get_desc(vq, &desc, i);
  2637			if (unlikely(ret)) {
  2638				vq_err(vq, "Failed to get descriptor: idx %d addr %p\n",
  2639				       i, vq->desc + i);
  2640				return -EFAULT;
  2641			}
  2642			if (desc.flags & cpu_to_vhost16(vq, VRING_DESC_F_INDIRECT)) {
  2643				ret = get_indirect(vq, iov, iov_size,
  2644						   out_num, in_num,
  2645						   log, log_num, &desc);
  2646				if (unlikely(ret < 0)) {
  2647					if (ret != -EAGAIN)
  2648						vq_err(vq, "Failure detected "
  2649							"in indirect descriptor at idx %d\n", i);
  2650					return ret;
  2651				}
  2652				continue;
  2653			}
  2654	
  2655			if (desc.flags & cpu_to_vhost16(vq, VRING_DESC_F_WRITE))
  2656				access = VHOST_ACCESS_WO;
  2657			else
  2658				access = VHOST_ACCESS_RO;
  2659			ret = translate_desc(vq, vhost64_to_cpu(vq, desc.addr),
  2660					     vhost32_to_cpu(vq, desc.len), iov + iov_count,
  2661					     iov_size - iov_count, access);
  2662			if (unlikely(ret < 0)) {
  2663				if (ret != -EAGAIN)
  2664					vq_err(vq, "Translation failure %d descriptor idx %d\n",
  2665						ret, i);
  2666				return ret;
  2667			}
  2668			if (access == VHOST_ACCESS_WO) {
  2669				/* If this is an input descriptor,
  2670				 * increment that count. */
  2671				*in_num += ret;
  2672				if (unlikely(log && ret)) {
  2673					log[*log_num].addr = vhost64_to_cpu(vq, desc.addr);
  2674					log[*log_num].len = vhost32_to_cpu(vq, desc.len);
  2675					++*log_num;
  2676				}
  2677			} else {
  2678				/* If it's an output descriptor, they're all supposed
  2679				 * to come before any input descriptors. */
  2680				if (unlikely(*in_num)) {
  2681					vq_err(vq, "Descriptor has out after in: "
  2682					       "idx %d\n", i);
  2683					return -EINVAL;
  2684				}
  2685				*out_num += ret;
  2686			}
  2687		} while ((i = next_desc(vq, &desc)) != -1);
  2688	
  2689		/* On success, increment avail index. */
  2690		vq->last_avail_idx++;
  2691	
  2692		/* Assume notifications from guest are disabled at this point,
  2693		 * if they aren't we would need to update avail_event index. */
  2694		BUG_ON(!(vq->used_flags & VRING_USED_F_NO_NOTIFY));
  2695		return head;
  2696	}
  2697	EXPORT_SYMBOL_GPL(vhost_get_vq_desc);
  2698	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki