Re: [RFC PATCH v3 1/3] blk-mq: Clean up references to old requests when freeing rqs

[kernel test robot <lkp@intel.com>]

[-- Attachment #1: Type: text/plain, Size: 2986 bytes --]

Hi John,

[FYI, it's a private test report for your RFC patch.]
[auto build test WARNING on block/for-next]
[also build test WARNING on v5.12-rc2 next-20210305]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/John-Garry/blk-mq-Avoid-use-after-free-for-accessing-old-requests/20210307-114941
base:   https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git for-next
config: x86_64-randconfig-s021-20210307 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce:
        # apt-get install sparse
        # sparse version: v0.6.3-245-gacc5c298-dirty
        # https://github.com/0day-ci/linux/commit/674e3d5c77574c2d47df2cf8ab12c48064bac870
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review John-Garry/blk-mq-Avoid-use-after-free-for-accessing-old-requests/20210307-114941
        git checkout 674e3d5c77574c2d47df2cf8ab12c48064bac870
        # save the attached .config to linux build tree
        make W=1 C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' ARCH=x86_64 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>


"sparse warnings: (new ones prefixed by >>)"
>> block/blk-mq.c:2306:33: sparse: sparse: Using plain integer as NULL pointer
>> block/blk-mq.c:2289:6: sparse: sparse: symbol '__blk_mq_free_rqs_ext' was not declared. Should it be static?

Please review and possibly fold the followup patch.

vim +2306 block/blk-mq.c

  2288	
> 2289	void __blk_mq_free_rqs_ext(struct blk_mq_tag_set *set, struct blk_mq_tags *tags,
  2290			     unsigned int hctx_idx, struct blk_mq_tags *ref_tags)
  2291	{
  2292		struct page *page;
  2293	
  2294		if (tags->rqs && set->ops->exit_request) {
  2295			int i;
  2296	
  2297			for (i = 0; i < tags->nr_tags; i++) {
  2298				struct request *rq = tags->static_rqs[i];
  2299				int j;
  2300	
  2301				if (!rq)
  2302					continue;
  2303				set->ops->exit_request(set, rq, hctx_idx);
  2304				/* clean up any references which occur in @ref_tags */
  2305				for (j = 0; ref_tags && j < ref_tags->nr_tags; j++)
> 2306					cmpxchg(&ref_tags->rqs[j], rq, 0);
  2307				tags->static_rqs[i] = NULL;
  2308			}
  2309		}
  2310	
  2311		while (!list_empty(&tags->page_list)) {
  2312			page = list_first_entry(&tags->page_list, struct page, lru);
  2313			list_del_init(&page->lru);
  2314			/*
  2315			 * Remove kmemleak object previously allocated in
  2316			 * blk_mq_alloc_rqs().
  2317			 */
  2318			kmemleak_free(page_address(page));
  2319			__free_pages(page, page->private);
  2320		}
  2321	}
  2322	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 37439 bytes --]