All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@oracle.com>
To: cluster-devel.redhat.com
Subject: [Cluster-devel] [gfs2:for-next.bob7e 4/13] fs/gfs2/super.c:1494 gfs2_evict_inode() warn: variable dereferenced before check 'ip->i_gl' (see line 1444)
Date: Thu, 3 Sep 2020 15:16:35 +0300	[thread overview]
Message-ID: <20200903121635.GC8299@kadam> (raw)

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git for-next.bob7e
head:   3bf4dea2e4dafeb54864937fbc2209cc5760d06b
commit: 702eb236642082541af33b509af9f046a0152a65 [4/13] gfs2: truncate glock address space pages during evict
config: x86_64-randconfig-m001-20200902 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

smatch warnings:
fs/gfs2/super.c:1494 gfs2_evict_inode() warn: variable dereferenced before check 'ip->i_gl' (see line 1444)

# https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git/commit/?id=702eb236642082541af33b509af9f046a0152a65
git remote add gfs2 https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git
git fetch --no-tags gfs2 for-next.bob7e
git checkout 702eb236642082541af33b509af9f046a0152a65
vim +1494 fs/gfs2/super.c

f1aeb35cc28dc6 Bob Peterson        2020-09-01  1430  static void gfs2_evict_inode(struct inode *inode)
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1431  {
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1432  	struct super_block *sb = inode->i_sb;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1433  	struct gfs2_sbd *sdp = sb->s_fs_info;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1434  	struct gfs2_inode *ip = GFS2_I(inode);
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1435  	struct gfs2_holder gh;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1436  	struct address_space *metamapping;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1437  	int error;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1438  
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1439  	if (test_bit(GIF_FREE_VFS_INODE, &ip->i_flags)) {
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1440  		clear_inode(inode);
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1441  		return;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1442  	}
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1443  
702eb236642082 Bob Peterson        2020-09-01 @1444  	metamapping = gfs2_glock2aspace(ip->i_gl);
                                                                                        ^^^^^^^^
Unchecked dereference in new code.

f1aeb35cc28dc6 Bob Peterson        2020-09-01  1445  	if (inode->i_nlink || sb_rdonly(sb))
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1446  		goto out;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1447  
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1448  	gfs2_holder_mark_uninitialized(&gh);
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1449  	error = evict_unlinked(inode, &gh);
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1450  	if (error == -EEXIST) /* this gets ignored */
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1451  		goto out;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1452  	if (error)
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1453  		goto out_unlock;
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1454  
805c090750a315 Bob Peterson        2018-01-08  1455  	gfs2_log_flush(sdp, ip->i_gl, GFS2_LOG_HEAD_FLUSH_NORMAL |
805c090750a315 Bob Peterson        2018-01-08  1456  		       GFS2_LFC_EVICT_INODE);
2216db70c95a96 Benjamin Marzinski  2012-09-20  1457  	if (test_bit(GLF_DIRTY, &ip->i_gl->gl_flags)) {
2216db70c95a96 Benjamin Marzinski  2012-09-20  1458  		filemap_fdatawrite(metamapping);
2216db70c95a96 Benjamin Marzinski  2012-09-20  1459  		filemap_fdatawait(metamapping);
2216db70c95a96 Benjamin Marzinski  2012-09-20  1460  	}
40ac218f52aa5c Steven Whitehouse   2011-08-02  1461  	write_inode_now(inode, 1);
b5b24d7aeb9608 Steven Whitehouse   2011-09-07  1462  	gfs2_ail_flush(ip->i_gl, 0);
40ac218f52aa5c Steven Whitehouse   2011-08-02  1463  
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1464  	error = gfs2_trans_begin(sdp, 0, sdp->sd_jdesc->jd_blocks);
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1465  	if (error)
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1466  		goto out_unlock;
380f7c65a7eb32 Steven Whitehouse   2011-07-14  1467  	/* Needs to be done before glock release & also in a transaction */
380f7c65a7eb32 Steven Whitehouse   2011-07-14  1468  	truncate_inode_pages(&inode->i_data, 0);
ee530beafeca98 Bob Peterson        2015-12-07  1469  	truncate_inode_pages(metamapping, 0);
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1470  	gfs2_trans_end(sdp);
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1471  
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1472  out_unlock:
a097dc7e24cba7 Bob Peterson        2015-07-16  1473  	if (gfs2_rs_active(&ip->i_res))
a097dc7e24cba7 Bob Peterson        2015-07-16  1474  		gfs2_rs_deltree(&ip->i_res);
8e2e00473598dd Bob Peterson        2012-07-19  1475  
240c6235dfe4fe Bob Peterson        2017-07-18  1476  	if (gfs2_holder_initialized(&gh)) {
240c6235dfe4fe Bob Peterson        2017-07-18  1477  		glock_clear_object(ip->i_gl, ip);
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1478  		gfs2_glock_dq_uninit(&gh);
240c6235dfe4fe Bob Peterson        2017-07-18  1479  	}
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1480  	if (error && error != GLR_TRYFAILED && error != -EROFS)
d5c1515cf37495 Al Viro             2010-06-07  1481  		fs_warn(sdp, "gfs2_evict_inode: %d\n", error);
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1482  out:
702eb236642082 Bob Peterson        2020-09-01  1483  	/* The following calls to truncate_inode_pages_final are not within
702eb236642082 Bob Peterson        2020-09-01  1484  	 * a transaction, so it's a bug if the inode still has dirty pages. */
702eb236642082 Bob Peterson        2020-09-01  1485  	BUG_ON(!gfs2_withdrawn(sdp) && inode->i_state & I_DIRTY);
91b0abe36a7b2b Johannes Weiner     2014-04-03  1486  	truncate_inode_pages_final(&inode->i_data);
702eb236642082 Bob Peterson        2020-09-01  1487  	truncate_inode_pages_final(metamapping);
2fba46a04c383f Bob Peterson        2020-02-27  1488  	if (ip->i_qadata)
2fba46a04c383f Bob Peterson        2020-02-27  1489  		gfs2_assert_warn(sdp, ip->i_qadata->qa_ref == 0);
1595548fe72ca8 Andreas Gruenbacher 2020-03-06  1490  	gfs2_rs_delete(ip, NULL);
4513899092b325 Steven Whitehouse   2013-01-28  1491  	gfs2_ordered_del_inode(ip);
dbd5768f87ff6f Jan Kara            2012-05-03  1492  	clear_inode(inode);
17d539f0499fa2 Steven Whitehouse   2011-06-15  1493  	gfs2_dir_hash_inval(ip);
40e7e86ef16550 Andreas Gruenbacher 2020-01-24 @1494  	if (ip->i_gl) {
                                                            ^^^^^^^^
January code assumes it can be NULL.

df3d87bde12121 Bob Peterson        2017-07-18  1495  		glock_clear_object(ip->i_gl, ip);
4fd1a5795214bc Andreas Gruenbacher 2017-06-30  1496  		wait_on_bit_io(&ip->i_flags, GIF_GLOP_PENDING, TASK_UNINTERRUPTIBLE);
29687a2ac8dfcd Steven Whitehouse   2011-03-30  1497  		gfs2_glock_add_to_lru(ip->i_gl);
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1498  		gfs2_glock_put_eventually(ip->i_gl);
d5c1515cf37495 Al Viro             2010-06-07  1499  		ip->i_gl = NULL;
40e7e86ef16550 Andreas Gruenbacher 2020-01-24  1500  	}
6df9f9a253c7dc Andreas Gruenbacher 2016-06-17  1501  	if (gfs2_holder_initialized(&ip->i_iopen_gh)) {
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1502  		struct gfs2_glock *gl = ip->i_iopen_gh.gh_gl;
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1503  
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1504  		glock_clear_object(gl, ip);
40e7e86ef16550 Andreas Gruenbacher 2020-01-24  1505  		if (test_bit(HIF_HOLDER, &ip->i_iopen_gh.gh_iflags)) {
a6a4d98b0124b5 Bob Peterson        2013-05-29  1506  			ip->i_iopen_gh.gh_flags |= GL_NOCACHE;
40e7e86ef16550 Andreas Gruenbacher 2020-01-24  1507  			gfs2_glock_dq(&ip->i_iopen_gh);
40e7e86ef16550 Andreas Gruenbacher 2020-01-24  1508  		}
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1509  		gfs2_glock_hold(gl);
40e7e86ef16550 Andreas Gruenbacher 2020-01-24  1510  		gfs2_holder_uninit(&ip->i_iopen_gh);
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1511  		gfs2_glock_put_eventually(gl);
d5c1515cf37495 Al Viro             2010-06-07  1512  	}
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1513  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all at lists.01.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: .config.gz
Type: application/gzip
Size: 29174 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/cluster-devel/attachments/20200903/719665eb/attachment.gz>

WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: kbuild@lists.01.org
Subject: [gfs2:for-next.bob7e 4/13] fs/gfs2/super.c:1494 gfs2_evict_inode() warn: variable dereferenced before check 'ip->i_gl' (see line 1444)
Date: Thu, 03 Sep 2020 15:16:35 +0300	[thread overview]
Message-ID: <20200903121635.GC8299@kadam> (raw)

[-- Attachment #1: Type: text/plain, Size: 8364 bytes --]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git for-next.bob7e
head:   3bf4dea2e4dafeb54864937fbc2209cc5760d06b
commit: 702eb236642082541af33b509af9f046a0152a65 [4/13] gfs2: truncate glock address space pages during evict
config: x86_64-randconfig-m001-20200902 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

smatch warnings:
fs/gfs2/super.c:1494 gfs2_evict_inode() warn: variable dereferenced before check 'ip->i_gl' (see line 1444)

# https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git/commit/?id=702eb236642082541af33b509af9f046a0152a65
git remote add gfs2 https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git
git fetch --no-tags gfs2 for-next.bob7e
git checkout 702eb236642082541af33b509af9f046a0152a65
vim +1494 fs/gfs2/super.c

f1aeb35cc28dc6 Bob Peterson        2020-09-01  1430  static void gfs2_evict_inode(struct inode *inode)
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1431  {
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1432  	struct super_block *sb = inode->i_sb;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1433  	struct gfs2_sbd *sdp = sb->s_fs_info;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1434  	struct gfs2_inode *ip = GFS2_I(inode);
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1435  	struct gfs2_holder gh;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1436  	struct address_space *metamapping;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1437  	int error;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1438  
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1439  	if (test_bit(GIF_FREE_VFS_INODE, &ip->i_flags)) {
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1440  		clear_inode(inode);
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1441  		return;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1442  	}
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1443  
702eb236642082 Bob Peterson        2020-09-01 @1444  	metamapping = gfs2_glock2aspace(ip->i_gl);
                                                                                        ^^^^^^^^
Unchecked dereference in new code.

f1aeb35cc28dc6 Bob Peterson        2020-09-01  1445  	if (inode->i_nlink || sb_rdonly(sb))
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1446  		goto out;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1447  
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1448  	gfs2_holder_mark_uninitialized(&gh);
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1449  	error = evict_unlinked(inode, &gh);
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1450  	if (error == -EEXIST) /* this gets ignored */
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1451  		goto out;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1452  	if (error)
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1453  		goto out_unlock;
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1454  
805c090750a315 Bob Peterson        2018-01-08  1455  	gfs2_log_flush(sdp, ip->i_gl, GFS2_LOG_HEAD_FLUSH_NORMAL |
805c090750a315 Bob Peterson        2018-01-08  1456  		       GFS2_LFC_EVICT_INODE);
2216db70c95a96 Benjamin Marzinski  2012-09-20  1457  	if (test_bit(GLF_DIRTY, &ip->i_gl->gl_flags)) {
2216db70c95a96 Benjamin Marzinski  2012-09-20  1458  		filemap_fdatawrite(metamapping);
2216db70c95a96 Benjamin Marzinski  2012-09-20  1459  		filemap_fdatawait(metamapping);
2216db70c95a96 Benjamin Marzinski  2012-09-20  1460  	}
40ac218f52aa5c Steven Whitehouse   2011-08-02  1461  	write_inode_now(inode, 1);
b5b24d7aeb9608 Steven Whitehouse   2011-09-07  1462  	gfs2_ail_flush(ip->i_gl, 0);
40ac218f52aa5c Steven Whitehouse   2011-08-02  1463  
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1464  	error = gfs2_trans_begin(sdp, 0, sdp->sd_jdesc->jd_blocks);
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1465  	if (error)
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1466  		goto out_unlock;
380f7c65a7eb32 Steven Whitehouse   2011-07-14  1467  	/* Needs to be done before glock release & also in a transaction */
380f7c65a7eb32 Steven Whitehouse   2011-07-14  1468  	truncate_inode_pages(&inode->i_data, 0);
ee530beafeca98 Bob Peterson        2015-12-07  1469  	truncate_inode_pages(metamapping, 0);
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1470  	gfs2_trans_end(sdp);
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1471  
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1472  out_unlock:
a097dc7e24cba7 Bob Peterson        2015-07-16  1473  	if (gfs2_rs_active(&ip->i_res))
a097dc7e24cba7 Bob Peterson        2015-07-16  1474  		gfs2_rs_deltree(&ip->i_res);
8e2e00473598dd Bob Peterson        2012-07-19  1475  
240c6235dfe4fe Bob Peterson        2017-07-18  1476  	if (gfs2_holder_initialized(&gh)) {
240c6235dfe4fe Bob Peterson        2017-07-18  1477  		glock_clear_object(ip->i_gl, ip);
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1478  		gfs2_glock_dq_uninit(&gh);
240c6235dfe4fe Bob Peterson        2017-07-18  1479  	}
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1480  	if (error && error != GLR_TRYFAILED && error != -EROFS)
d5c1515cf37495 Al Viro             2010-06-07  1481  		fs_warn(sdp, "gfs2_evict_inode: %d\n", error);
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1482  out:
702eb236642082 Bob Peterson        2020-09-01  1483  	/* The following calls to truncate_inode_pages_final are not within
702eb236642082 Bob Peterson        2020-09-01  1484  	 * a transaction, so it's a bug if the inode still has dirty pages. */
702eb236642082 Bob Peterson        2020-09-01  1485  	BUG_ON(!gfs2_withdrawn(sdp) && inode->i_state & I_DIRTY);
91b0abe36a7b2b Johannes Weiner     2014-04-03  1486  	truncate_inode_pages_final(&inode->i_data);
702eb236642082 Bob Peterson        2020-09-01  1487  	truncate_inode_pages_final(metamapping);
2fba46a04c383f Bob Peterson        2020-02-27  1488  	if (ip->i_qadata)
2fba46a04c383f Bob Peterson        2020-02-27  1489  		gfs2_assert_warn(sdp, ip->i_qadata->qa_ref == 0);
1595548fe72ca8 Andreas Gruenbacher 2020-03-06  1490  	gfs2_rs_delete(ip, NULL);
4513899092b325 Steven Whitehouse   2013-01-28  1491  	gfs2_ordered_del_inode(ip);
dbd5768f87ff6f Jan Kara            2012-05-03  1492  	clear_inode(inode);
17d539f0499fa2 Steven Whitehouse   2011-06-15  1493  	gfs2_dir_hash_inval(ip);
40e7e86ef16550 Andreas Gruenbacher 2020-01-24 @1494  	if (ip->i_gl) {
                                                            ^^^^^^^^
January code assumes it can be NULL.

df3d87bde12121 Bob Peterson        2017-07-18  1495  		glock_clear_object(ip->i_gl, ip);
4fd1a5795214bc Andreas Gruenbacher 2017-06-30  1496  		wait_on_bit_io(&ip->i_flags, GIF_GLOP_PENDING, TASK_UNINTERRUPTIBLE);
29687a2ac8dfcd Steven Whitehouse   2011-03-30  1497  		gfs2_glock_add_to_lru(ip->i_gl);
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1498  		gfs2_glock_put_eventually(ip->i_gl);
d5c1515cf37495 Al Viro             2010-06-07  1499  		ip->i_gl = NULL;
40e7e86ef16550 Andreas Gruenbacher 2020-01-24  1500  	}
6df9f9a253c7dc Andreas Gruenbacher 2016-06-17  1501  	if (gfs2_holder_initialized(&ip->i_iopen_gh)) {
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1502  		struct gfs2_glock *gl = ip->i_iopen_gh.gh_gl;
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1503  
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1504  		glock_clear_object(gl, ip);
40e7e86ef16550 Andreas Gruenbacher 2020-01-24  1505  		if (test_bit(HIF_HOLDER, &ip->i_iopen_gh.gh_iflags)) {
a6a4d98b0124b5 Bob Peterson        2013-05-29  1506  			ip->i_iopen_gh.gh_flags |= GL_NOCACHE;
40e7e86ef16550 Andreas Gruenbacher 2020-01-24  1507  			gfs2_glock_dq(&ip->i_iopen_gh);
40e7e86ef16550 Andreas Gruenbacher 2020-01-24  1508  		}
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1509  		gfs2_glock_hold(gl);
40e7e86ef16550 Andreas Gruenbacher 2020-01-24  1510  		gfs2_holder_uninit(&ip->i_iopen_gh);
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1511  		gfs2_glock_put_eventually(gl);
d5c1515cf37495 Al Viro             2010-06-07  1512  	}
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1513  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 29174 bytes --]

WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: kbuild-all@lists.01.org
Subject: [gfs2:for-next.bob7e 4/13] fs/gfs2/super.c:1494 gfs2_evict_inode() warn: variable dereferenced before check 'ip->i_gl' (see line 1444)
Date: Thu, 03 Sep 2020 15:16:35 +0300	[thread overview]
Message-ID: <20200903121635.GC8299@kadam> (raw)

[-- Attachment #1: Type: text/plain, Size: 8364 bytes --]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git for-next.bob7e
head:   3bf4dea2e4dafeb54864937fbc2209cc5760d06b
commit: 702eb236642082541af33b509af9f046a0152a65 [4/13] gfs2: truncate glock address space pages during evict
config: x86_64-randconfig-m001-20200902 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

smatch warnings:
fs/gfs2/super.c:1494 gfs2_evict_inode() warn: variable dereferenced before check 'ip->i_gl' (see line 1444)

# https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git/commit/?id=702eb236642082541af33b509af9f046a0152a65
git remote add gfs2 https://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git
git fetch --no-tags gfs2 for-next.bob7e
git checkout 702eb236642082541af33b509af9f046a0152a65
vim +1494 fs/gfs2/super.c

f1aeb35cc28dc6 Bob Peterson        2020-09-01  1430  static void gfs2_evict_inode(struct inode *inode)
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1431  {
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1432  	struct super_block *sb = inode->i_sb;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1433  	struct gfs2_sbd *sdp = sb->s_fs_info;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1434  	struct gfs2_inode *ip = GFS2_I(inode);
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1435  	struct gfs2_holder gh;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1436  	struct address_space *metamapping;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1437  	int error;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1438  
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1439  	if (test_bit(GIF_FREE_VFS_INODE, &ip->i_flags)) {
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1440  		clear_inode(inode);
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1441  		return;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1442  	}
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1443  
702eb236642082 Bob Peterson        2020-09-01 @1444  	metamapping = gfs2_glock2aspace(ip->i_gl);
                                                                                        ^^^^^^^^
Unchecked dereference in new code.

f1aeb35cc28dc6 Bob Peterson        2020-09-01  1445  	if (inode->i_nlink || sb_rdonly(sb))
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1446  		goto out;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1447  
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1448  	gfs2_holder_mark_uninitialized(&gh);
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1449  	error = evict_unlinked(inode, &gh);
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1450  	if (error == -EEXIST) /* this gets ignored */
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1451  		goto out;
f1aeb35cc28dc6 Bob Peterson        2020-09-01  1452  	if (error)
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1453  		goto out_unlock;
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1454  
805c090750a315 Bob Peterson        2018-01-08  1455  	gfs2_log_flush(sdp, ip->i_gl, GFS2_LOG_HEAD_FLUSH_NORMAL |
805c090750a315 Bob Peterson        2018-01-08  1456  		       GFS2_LFC_EVICT_INODE);
2216db70c95a96 Benjamin Marzinski  2012-09-20  1457  	if (test_bit(GLF_DIRTY, &ip->i_gl->gl_flags)) {
2216db70c95a96 Benjamin Marzinski  2012-09-20  1458  		filemap_fdatawrite(metamapping);
2216db70c95a96 Benjamin Marzinski  2012-09-20  1459  		filemap_fdatawait(metamapping);
2216db70c95a96 Benjamin Marzinski  2012-09-20  1460  	}
40ac218f52aa5c Steven Whitehouse   2011-08-02  1461  	write_inode_now(inode, 1);
b5b24d7aeb9608 Steven Whitehouse   2011-09-07  1462  	gfs2_ail_flush(ip->i_gl, 0);
40ac218f52aa5c Steven Whitehouse   2011-08-02  1463  
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1464  	error = gfs2_trans_begin(sdp, 0, sdp->sd_jdesc->jd_blocks);
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1465  	if (error)
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1466  		goto out_unlock;
380f7c65a7eb32 Steven Whitehouse   2011-07-14  1467  	/* Needs to be done before glock release & also in a transaction */
380f7c65a7eb32 Steven Whitehouse   2011-07-14  1468  	truncate_inode_pages(&inode->i_data, 0);
ee530beafeca98 Bob Peterson        2015-12-07  1469  	truncate_inode_pages(metamapping, 0);
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1470  	gfs2_trans_end(sdp);
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1471  
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1472  out_unlock:
a097dc7e24cba7 Bob Peterson        2015-07-16  1473  	if (gfs2_rs_active(&ip->i_res))
a097dc7e24cba7 Bob Peterson        2015-07-16  1474  		gfs2_rs_deltree(&ip->i_res);
8e2e00473598dd Bob Peterson        2012-07-19  1475  
240c6235dfe4fe Bob Peterson        2017-07-18  1476  	if (gfs2_holder_initialized(&gh)) {
240c6235dfe4fe Bob Peterson        2017-07-18  1477  		glock_clear_object(ip->i_gl, ip);
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1478  		gfs2_glock_dq_uninit(&gh);
240c6235dfe4fe Bob Peterson        2017-07-18  1479  	}
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1480  	if (error && error != GLR_TRYFAILED && error != -EROFS)
d5c1515cf37495 Al Viro             2010-06-07  1481  		fs_warn(sdp, "gfs2_evict_inode: %d\n", error);
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1482  out:
702eb236642082 Bob Peterson        2020-09-01  1483  	/* The following calls to truncate_inode_pages_final are not within
702eb236642082 Bob Peterson        2020-09-01  1484  	 * a transaction, so it's a bug if the inode still has dirty pages. */
702eb236642082 Bob Peterson        2020-09-01  1485  	BUG_ON(!gfs2_withdrawn(sdp) && inode->i_state & I_DIRTY);
91b0abe36a7b2b Johannes Weiner     2014-04-03  1486  	truncate_inode_pages_final(&inode->i_data);
702eb236642082 Bob Peterson        2020-09-01  1487  	truncate_inode_pages_final(metamapping);
2fba46a04c383f Bob Peterson        2020-02-27  1488  	if (ip->i_qadata)
2fba46a04c383f Bob Peterson        2020-02-27  1489  		gfs2_assert_warn(sdp, ip->i_qadata->qa_ref == 0);
1595548fe72ca8 Andreas Gruenbacher 2020-03-06  1490  	gfs2_rs_delete(ip, NULL);
4513899092b325 Steven Whitehouse   2013-01-28  1491  	gfs2_ordered_del_inode(ip);
dbd5768f87ff6f Jan Kara            2012-05-03  1492  	clear_inode(inode);
17d539f0499fa2 Steven Whitehouse   2011-06-15  1493  	gfs2_dir_hash_inval(ip);
40e7e86ef16550 Andreas Gruenbacher 2020-01-24 @1494  	if (ip->i_gl) {
                                                            ^^^^^^^^
January code assumes it can be NULL.

df3d87bde12121 Bob Peterson        2017-07-18  1495  		glock_clear_object(ip->i_gl, ip);
4fd1a5795214bc Andreas Gruenbacher 2017-06-30  1496  		wait_on_bit_io(&ip->i_flags, GIF_GLOP_PENDING, TASK_UNINTERRUPTIBLE);
29687a2ac8dfcd Steven Whitehouse   2011-03-30  1497  		gfs2_glock_add_to_lru(ip->i_gl);
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1498  		gfs2_glock_put_eventually(ip->i_gl);
d5c1515cf37495 Al Viro             2010-06-07  1499  		ip->i_gl = NULL;
40e7e86ef16550 Andreas Gruenbacher 2020-01-24  1500  	}
6df9f9a253c7dc Andreas Gruenbacher 2016-06-17  1501  	if (gfs2_holder_initialized(&ip->i_iopen_gh)) {
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1502  		struct gfs2_glock *gl = ip->i_iopen_gh.gh_gl;
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1503  
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1504  		glock_clear_object(gl, ip);
40e7e86ef16550 Andreas Gruenbacher 2020-01-24  1505  		if (test_bit(HIF_HOLDER, &ip->i_iopen_gh.gh_iflags)) {
a6a4d98b0124b5 Bob Peterson        2013-05-29  1506  			ip->i_iopen_gh.gh_flags |= GL_NOCACHE;
40e7e86ef16550 Andreas Gruenbacher 2020-01-24  1507  			gfs2_glock_dq(&ip->i_iopen_gh);
40e7e86ef16550 Andreas Gruenbacher 2020-01-24  1508  		}
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1509  		gfs2_glock_hold(gl);
40e7e86ef16550 Andreas Gruenbacher 2020-01-24  1510  		gfs2_holder_uninit(&ip->i_iopen_gh);
71c1b2136835c8 Andreas Gruenbacher 2017-08-01  1511  		gfs2_glock_put_eventually(gl);
d5c1515cf37495 Al Viro             2010-06-07  1512  	}
9e6e0a128bca0a Steven Whitehouse   2009-05-22  1513  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 29174 bytes --]

             reply	other threads:[~2020-09-03 12:16 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-03 12:16 Dan Carpenter [this message]
2020-09-03 12:16 ` [gfs2:for-next.bob7e 4/13] fs/gfs2/super.c:1494 gfs2_evict_inode() warn: variable dereferenced before check 'ip->i_gl' (see line 1444) Dan Carpenter
2020-09-03 12:16 ` Dan Carpenter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200903121635.GC8299@kadam \
    --to=dan.carpenter@oracle.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.