tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: 84e57d292203a45c96dbcb2e6be9dd80961d981a commit: 64b4a25c3de81a69724e888ec2db3533b43816e2 ext4: add missing validation of fast-commit record lengths date: 7 days ago config: parisc-randconfig-s051-20221215 compiler: hppa-linux-gcc (GCC) 12.1.0 reproduce: wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # apt-get install sparse # sparse version: v0.6.4-39-gce1a6720-dirty # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=64b4a25c3de81a69724e888ec2db3533b43816e2 git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git git fetch --no-tags linus master git checkout 64b4a25c3de81a69724e888ec2db3533b43816e2 # save the config file mkdir build_dir && cp config build_dir/.config COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' O=build_dir ARCH=parisc SHELL=/bin/bash fs/ext4/ If you fix the issue, kindly add following tag where applicable | Reported-by: kernel test robot sparse warnings: (new ones prefixed by >>) fs/ext4/fast_commit.c:1536:42: sparse: sparse: incorrect type in initializer (different base types) @@ expected int tag @@ got restricted __le16 [usertype] fc_tag @@ fs/ext4/fast_commit.c:1536:42: sparse: expected int tag fs/ext4/fast_commit.c:1536:42: sparse: got restricted __le16 [usertype] fc_tag fs/ext4/fast_commit.c:1562:23: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2081:23: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2082:55: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected int tag @@ got restricted __le16 [addressable] [usertype] fc_tag @@ fs/ext4/fast_commit.c:2082:55: sparse: expected int tag fs/ext4/fast_commit.c:2082:55: sparse: got restricted __le16 [addressable] [usertype] fc_tag >> fs/ext4/fast_commit.c:2082:66: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected int [assigned] len @@ got restricted __le16 [addressable] [usertype] fc_len @@ fs/ext4/fast_commit.c:2082:66: sparse: expected int [assigned] len fs/ext4/fast_commit.c:2082:66: sparse: got restricted __le16 [addressable] [usertype] fc_len fs/ext4/fast_commit.c:2087:17: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned short [usertype] tag @@ got restricted __le16 [addressable] [usertype] fc_tag @@ fs/ext4/fast_commit.c:2087:17: sparse: expected unsigned short [usertype] tag fs/ext4/fast_commit.c:2087:17: sparse: got restricted __le16 [addressable] [usertype] fc_tag fs/ext4/fast_commit.c:2109:58: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2142:58: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2089:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2089:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2089:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2089:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2089:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2089:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2089:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2089:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2089:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2078:51: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2208:17: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned short [usertype] tag @@ got restricted __le16 [addressable] [usertype] fc_tag @@ fs/ext4/fast_commit.c:2208:17: sparse: expected unsigned short [usertype] tag fs/ext4/fast_commit.c:2208:17: sparse: got restricted __le16 [addressable] [usertype] fc_tag fs/ext4/fast_commit.c:2231:48: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected int priv1 @@ got restricted __le16 [addressable] [usertype] fc_len @@ fs/ext4/fast_commit.c:2231:48: sparse: expected int priv1 fs/ext4/fast_commit.c:2231:48: sparse: got restricted __le16 [addressable] [usertype] fc_len fs/ext4/fast_commit.c:2235:51: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected int priv1 @@ got restricted __le16 [addressable] [usertype] fc_len @@ fs/ext4/fast_commit.c:2235:51: sparse: expected int priv1 fs/ext4/fast_commit.c:2235:51: sparse: got restricted __le16 [addressable] [usertype] fc_len fs/ext4/fast_commit.c:2242:52: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected int tag @@ got restricted __le16 [addressable] [usertype] fc_tag @@ fs/ext4/fast_commit.c:2242:52: sparse: expected int tag fs/ext4/fast_commit.c:2242:52: sparse: got restricted __le16 [addressable] [usertype] fc_tag fs/ext4/fast_commit.c:2242:66: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected int priv1 @@ got restricted __le16 [addressable] [usertype] fc_len @@ fs/ext4/fast_commit.c:2242:66: sparse: expected int priv1 fs/ext4/fast_commit.c:2242:66: sparse: got restricted __le16 [addressable] [usertype] fc_len fs/ext4/fast_commit.c:2210:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2210:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2210:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2210:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2210:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2210:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2210:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2210:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2210:27: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:2198:51: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:1364:29: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:1364:29: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:1364:29: sparse: sparse: restricted __le16 degrades to integer fs/ext4/fast_commit.c:1370:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] fc_len @@ got unsigned short [usertype] @@ fs/ext4/fast_commit.c:1370:20: sparse: expected restricted __le16 [usertype] fc_len fs/ext4/fast_commit.c:1370:20: sparse: got unsigned short [usertype] fs/ext4/fast_commit.c:1371:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] fc_tag @@ got unsigned short [usertype] @@ fs/ext4/fast_commit.c:1371:20: sparse: expected restricted __le16 [usertype] fc_tag fs/ext4/fast_commit.c:1371:20: sparse: got unsigned short [usertype] fs/ext4/fast_commit.c:1370:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] fc_len @@ got unsigned short [usertype] @@ fs/ext4/fast_commit.c:1370:20: sparse: expected restricted __le16 [usertype] fc_len fs/ext4/fast_commit.c:1370:20: sparse: got unsigned short [usertype] fs/ext4/fast_commit.c:1371:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] fc_tag @@ got unsigned short [usertype] @@ fs/ext4/fast_commit.c:1371:20: sparse: expected restricted __le16 [usertype] fc_tag fs/ext4/fast_commit.c:1371:20: sparse: got unsigned short [usertype] vim +2082 fs/ext4/fast_commit.c 2020 2021 /* 2022 * Recovery Scan phase handler 2023 * 2024 * This function is called during the scan phase and is responsible 2025 * for doing following things: 2026 * - Make sure the fast commit area has valid tags for replay 2027 * - Count number of tags that need to be replayed by the replay handler 2028 * - Verify CRC 2029 * - Create a list of excluded blocks for allocation during replay phase 2030 * 2031 * This function returns JBD2_FC_REPLAY_CONTINUE to indicate that SCAN is 2032 * incomplete and JBD2 should send more blocks. It returns JBD2_FC_REPLAY_STOP 2033 * to indicate that scan has finished and JBD2 can now start replay phase. 2034 * It returns a negative error to indicate that there was an error. At the end 2035 * of a successful scan phase, sbi->s_fc_replay_state.fc_replay_num_tags is set 2036 * to indicate the number of tags that need to replayed during the replay phase. 2037 */ 2038 static int ext4_fc_replay_scan(journal_t *journal, 2039 struct buffer_head *bh, int off, 2040 tid_t expected_tid) 2041 { 2042 struct super_block *sb = journal->j_private; 2043 struct ext4_sb_info *sbi = EXT4_SB(sb); 2044 struct ext4_fc_replay_state *state; 2045 int ret = JBD2_FC_REPLAY_CONTINUE; 2046 struct ext4_fc_add_range ext; 2047 struct ext4_fc_tl tl; 2048 struct ext4_fc_tail tail; 2049 __u8 *start, *end, *cur, *val; 2050 struct ext4_fc_head head; 2051 struct ext4_extent *ex; 2052 2053 state = &sbi->s_fc_replay_state; 2054 2055 start = (u8 *)bh->b_data; 2056 end = (__u8 *)bh->b_data + journal->j_blocksize - 1; 2057 2058 if (state->fc_replay_expected_off == 0) { 2059 state->fc_cur_tag = 0; 2060 state->fc_replay_num_tags = 0; 2061 state->fc_crc = 0; 2062 state->fc_regions = NULL; 2063 state->fc_regions_valid = state->fc_regions_used = 2064 state->fc_regions_size = 0; 2065 /* Check if we can stop early */ 2066 if (le16_to_cpu(((struct ext4_fc_tl *)start)->fc_tag) 2067 != EXT4_FC_TAG_HEAD) 2068 return 0; 2069 } 2070 2071 if (off != state->fc_replay_expected_off) { 2072 ret = -EFSCORRUPTED; 2073 goto out_err; 2074 } 2075 2076 state->fc_replay_expected_off++; 2077 for (cur = start; cur < end - EXT4_FC_TAG_BASE_LEN; 2078 cur = cur + EXT4_FC_TAG_BASE_LEN + tl.fc_len) { 2079 ext4_fc_get_tl(&tl, cur); 2080 val = cur + EXT4_FC_TAG_BASE_LEN; 2081 if (tl.fc_len > end - val || > 2082 !ext4_fc_value_len_isvalid(sbi, tl.fc_tag, tl.fc_len)) { 2083 ret = state->fc_replay_num_tags ? 2084 JBD2_FC_REPLAY_STOP : -ECANCELED; 2085 goto out_err; 2086 } 2087 ext4_debug("Scan phase, tag:%s, blk %lld\n", 2088 tag2str(tl.fc_tag), bh->b_blocknr); 2089 switch (tl.fc_tag) { 2090 case EXT4_FC_TAG_ADD_RANGE: 2091 memcpy(&ext, val, sizeof(ext)); 2092 ex = (struct ext4_extent *)&ext.fc_ex; 2093 ret = ext4_fc_record_regions(sb, 2094 le32_to_cpu(ext.fc_ino), 2095 le32_to_cpu(ex->ee_block), ext4_ext_pblock(ex), 2096 ext4_ext_get_actual_len(ex), 0); 2097 if (ret < 0) 2098 break; 2099 ret = JBD2_FC_REPLAY_CONTINUE; 2100 fallthrough; 2101 case EXT4_FC_TAG_DEL_RANGE: 2102 case EXT4_FC_TAG_LINK: 2103 case EXT4_FC_TAG_UNLINK: 2104 case EXT4_FC_TAG_CREAT: 2105 case EXT4_FC_TAG_INODE: 2106 case EXT4_FC_TAG_PAD: 2107 state->fc_cur_tag++; 2108 state->fc_crc = ext4_chksum(sbi, state->fc_crc, cur, 2109 EXT4_FC_TAG_BASE_LEN + tl.fc_len); 2110 break; 2111 case EXT4_FC_TAG_TAIL: 2112 state->fc_cur_tag++; 2113 memcpy(&tail, val, sizeof(tail)); 2114 state->fc_crc = ext4_chksum(sbi, state->fc_crc, cur, 2115 EXT4_FC_TAG_BASE_LEN + 2116 offsetof(struct ext4_fc_tail, 2117 fc_crc)); 2118 if (le32_to_cpu(tail.fc_tid) == expected_tid && 2119 le32_to_cpu(tail.fc_crc) == state->fc_crc) { 2120 state->fc_replay_num_tags = state->fc_cur_tag; 2121 state->fc_regions_valid = 2122 state->fc_regions_used; 2123 } else { 2124 ret = state->fc_replay_num_tags ? 2125 JBD2_FC_REPLAY_STOP : -EFSBADCRC; 2126 } 2127 state->fc_crc = 0; 2128 break; 2129 case EXT4_FC_TAG_HEAD: 2130 memcpy(&head, val, sizeof(head)); 2131 if (le32_to_cpu(head.fc_features) & 2132 ~EXT4_FC_SUPPORTED_FEATURES) { 2133 ret = -EOPNOTSUPP; 2134 break; 2135 } 2136 if (le32_to_cpu(head.fc_tid) != expected_tid) { 2137 ret = JBD2_FC_REPLAY_STOP; 2138 break; 2139 } 2140 state->fc_cur_tag++; 2141 state->fc_crc = ext4_chksum(sbi, state->fc_crc, cur, 2142 EXT4_FC_TAG_BASE_LEN + tl.fc_len); 2143 break; 2144 default: 2145 ret = state->fc_replay_num_tags ? 2146 JBD2_FC_REPLAY_STOP : -ECANCELED; 2147 } 2148 if (ret < 0 || ret == JBD2_FC_REPLAY_STOP) 2149 break; 2150 } 2151 2152 out_err: 2153 trace_ext4_fc_replay_scan(sb, ret, off); 2154 return ret; 2155 } 2156 -- 0-DAY CI Kernel Test Service https://01.org/lkp