From: Chuck Lever III <chuck.lever@oracle.com>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: "kbuild@lists.01.org" <kbuild@lists.01.org>,
kernel test robot <lkp@intel.com>,
"kbuild-all@lists.01.org" <kbuild-all@lists.01.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Trond Myklebust <trond.myklebust@hammerspace.com>
Subject: Re: net/sunrpc/xprtrdma/frwr_ops.c:647 frwr_unmap_async() error: potentially dereferencing uninitialized 'last'.
Date: Wed, 23 Jun 2021 12:20:10 +0000 [thread overview]
Message-ID: <AAA93115-ABDD-44DA-9784-B8A001E9CEC5@oracle.com> (raw)
In-Reply-To: <202106231840.ECkPJRDx-lkp@intel.com>
Howdy Dan!
> On Jun 23, 2021, at 6:07 AM, Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> head: 0c18f29aae7ce3dadd26d8ee3505d07cc982df75
> commit: e10fa96d347488d1fd278e84f52ba7b25067cc71 xprtrdma: Move cqe to struct rpcrdma_mr
> config: x86_64-randconfig-m001-20210622 (attached as .config)
> compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
>
> If you fix the issue, kindly add following tag as appropriate
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> New smatch warnings:
> net/sunrpc/xprtrdma/frwr_ops.c:647 frwr_unmap_async() error: potentially dereferencing uninitialized 'last'.
>
> Old smatch warnings:
> net/sunrpc/xprtrdma/frwr_ops.c:546 frwr_unmap_sync() error: potentially dereferencing uninitialized 'last'.
>
> vim +/last +647 net/sunrpc/xprtrdma/frwr_ops.c
>
> d8099feda4833b Chuck Lever 2019-06-19 608 void frwr_unmap_async(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req)
> d8099feda4833b Chuck Lever 2019-06-19 609 {
> d8099feda4833b Chuck Lever 2019-06-19 610 struct ib_send_wr *first, *last, **prev;
> 5ecef9c8436695 Chuck Lever 2020-11-09 611 struct rpcrdma_ep *ep = r_xprt->rx_ep;
> d8099feda4833b Chuck Lever 2019-06-19 612 struct rpcrdma_frwr *frwr;
> d8099feda4833b Chuck Lever 2019-06-19 613 struct rpcrdma_mr *mr;
> d8099feda4833b Chuck Lever 2019-06-19 614 int rc;
> d8099feda4833b Chuck Lever 2019-06-19 615
> d8099feda4833b Chuck Lever 2019-06-19 616 /* Chain the LOCAL_INV Work Requests and post them with
> d8099feda4833b Chuck Lever 2019-06-19 617 * a single ib_post_send() call.
> d8099feda4833b Chuck Lever 2019-06-19 618 */
> d8099feda4833b Chuck Lever 2019-06-19 619 frwr = NULL;
> d8099feda4833b Chuck Lever 2019-06-19 620 prev = &first;
> 265a38d4611360 Chuck Lever 2019-08-19 621 while ((mr = rpcrdma_mr_pop(&req->rl_registered))) {
>
> Is it possible for the ->rl_registered list to be empty?
The one and only call site for frwr_unmap_async() in in rpcrdma_reply_handler():
1483 if (!list_empty(&req->rl_registered))
1484 frwr_unmap_async(r_xprt, req);
1485 /* LocalInv completion will complete the RPC */
1486 else
1487 kref_put(&req->rl_kref, rpcrdma_reply_done);
> If not, then just ignore this email.
I seem to recall smatch catching this problem before. Is there a way
to annotate frwr_unmap_async() to calm smatch's nerves?
> d8099feda4833b Chuck Lever 2019-06-19 622
> d8099feda4833b Chuck Lever 2019-06-19 623 trace_xprtrdma_mr_localinv(mr);
> d8099feda4833b Chuck Lever 2019-06-19 624 r_xprt->rx_stats.local_inv_needed++;
> d8099feda4833b Chuck Lever 2019-06-19 625
> d8099feda4833b Chuck Lever 2019-06-19 626 frwr = &mr->frwr;
> d8099feda4833b Chuck Lever 2019-06-19 627 last = &frwr->fr_invwr;
> d8099feda4833b Chuck Lever 2019-06-19 628 last->next = NULL;
> e10fa96d347488 Chuck Lever 2021-04-19 629 last->wr_cqe = &mr->mr_cqe;
> d8099feda4833b Chuck Lever 2019-06-19 630 last->sg_list = NULL;
> d8099feda4833b Chuck Lever 2019-06-19 631 last->num_sge = 0;
> d8099feda4833b Chuck Lever 2019-06-19 632 last->opcode = IB_WR_LOCAL_INV;
> d8099feda4833b Chuck Lever 2019-06-19 633 last->send_flags = IB_SEND_SIGNALED;
> d8099feda4833b Chuck Lever 2019-06-19 634 last->ex.invalidate_rkey = mr->mr_handle;
> d8099feda4833b Chuck Lever 2019-06-19 635
> e10fa96d347488 Chuck Lever 2021-04-19 636 last->wr_cqe->done = frwr_wc_localinv;
> e10fa96d347488 Chuck Lever 2021-04-19 637
> d8099feda4833b Chuck Lever 2019-06-19 638 *prev = last;
> d8099feda4833b Chuck Lever 2019-06-19 639 prev = &last->next;
> d8099feda4833b Chuck Lever 2019-06-19 640 }
> d8099feda4833b Chuck Lever 2019-06-19 641
> d8099feda4833b Chuck Lever 2019-06-19 642 /* Strong send queue ordering guarantees that when the
> d8099feda4833b Chuck Lever 2019-06-19 643 * last WR in the chain completes, all WRs in the chain
> d8099feda4833b Chuck Lever 2019-06-19 644 * are complete. The last completion will wake up the
> d8099feda4833b Chuck Lever 2019-06-19 645 * RPC waiter.
> d8099feda4833b Chuck Lever 2019-06-19 646 */
> e10fa96d347488 Chuck Lever 2021-04-19 @647 last->wr_cqe->done = frwr_wc_localinv_done;
>
> ---
> 0-DAY CI Kernel Test Service, Intel Corporation
> https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
>
--
Chuck Lever
next prev parent reply other threads:[~2021-06-23 12:20 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-23 10:07 Dan Carpenter
2021-06-23 12:20 ` Chuck Lever III [this message]
2021-06-23 12:27 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=AAA93115-ABDD-44DA-9784-B8A001E9CEC5@oracle.com \
--to=chuck.lever@oracle.com \
--cc=dan.carpenter@oracle.com \
--cc=kbuild-all@lists.01.org \
--cc=kbuild@lists.01.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@intel.com \
--cc=trond.myklebust@hammerspace.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®