:::::: :::::: Manual check reason: "low confidence bisect report" :::::: Manual check reason: "low confidence static check warning: drivers/block/ublk_drv.c:2107:15: warning: use of uninitialized value 'mask' [CWE-457] [-Wanalyzer-use-of-uninitialized-value]" :::::: BCC: lkp@intel.com CC: oe-kbuild-all@lists.linux.dev In-Reply-To: <20221116060835.159945-7-ming.lei@redhat.com> References: <20221116060835.159945-7-ming.lei@redhat.com> TO: Ming Lei TO: Jens Axboe CC: linux-block@vger.kernel.org CC: ZiyangZhang CC: Stefan Hajnoczi CC: Ming Lei Hi Ming, I love your patch! Perhaps something to improve: [auto build test WARNING on linus/master] [also build test WARNING on v6.1-rc6 next-20221125] [cannot apply to axboe-block/for-next] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Ming-Lei/ublk_drv-add-mechanism-for-supporting-unprivileged-ublk-device/20221116-141131 patch link: https://lore.kernel.org/r/20221116060835.159945-7-ming.lei%40redhat.com patch subject: [PATCH 6/6] ublk_drv: add mechanism for supporting unprivileged ublk device :::::: branch date: 11 days ago :::::: commit date: 11 days ago config: arm-randconfig-c002-20221124 compiler: arm-linux-gnueabi-gcc (GCC) 12.1.0 reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://github.com/intel-lab-lkp/linux/commit/a922b5da71a7776620e29e8d8cf9e4aa8bb0b9e1 git remote add linux-review https://github.com/intel-lab-lkp/linux git fetch --no-tags linux-review Ming-Lei/ublk_drv-add-mechanism-for-supporting-unprivileged-ublk-device/20221116-141131 git checkout a922b5da71a7776620e29e8d8cf9e4aa8bb0b9e1 # save the config file COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross ARCH=arm KBUILD_USERCFLAGS='-fanalyzer -Wno-error' If you fix the issue, kindly add following tag where applicable | Reported-by: kernel test robot gcc_analyzer warnings: (new ones prefixed by >>) drivers/block/ublk_drv.c: In function 'ublk_submit_cmd': drivers/block/ublk_drv.c:808:42: warning: dereference of NULL 'rq' [CWE-476] [-Wanalyzer-null-dereference] 808 | struct ublk_io *io = &ubq->ios[rq->tag]; | ~~^~~~~ 'ublk_handle_need_get_data': event 1 | | 1217 | static void ublk_handle_need_get_data(struct ublk_device *ub, int q_id, | | ^~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (1) entry to 'ublk_handle_need_get_data' | 'ublk_handle_need_get_data': event 2 | |include/linux/blk-mq.h:762:12: | 762 | if (tag < tags->nr_tags) { | | ^ | | | | | (2) following 'false' branch... | 'ublk_handle_need_get_data': events 3-4 | |drivers/block/ublk_drv.c:1221:31: | 1221 | struct request *req = blk_mq_tag_to_rq(ub->tag_set.tags[q_id], tag); | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (3) ...to here | 1222 | | 1223 | ublk_queue_cmd(ubq, req, true); | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (4) calling 'ublk_queue_cmd' from 'ublk_handle_need_get_data' | +--> 'ublk_queue_cmd': events 5-10 | | 295 | if (IS_BUILTIN(CONFIG_BLK_DEV_UBLK) && | | ~ | | | | | (6) following 'false' branch... |...... | 837 | static void ublk_queue_cmd(struct ublk_queue *ubq, struct request *rq, | | ^~~~~~~~~~~~~~ | | | | | (5) entry to 'ublk_queue_cmd' |...... | 842 | if (ublk_can_use_task_work(ubq)) { | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (7) ...to here |...... | 849 | if (llist_add(&data->node, &ubq->io_cmds)) | | ~ | | | | | (8) following 'true' branch... | 850 | ublk_submit_cmd(ubq, rq); | | ~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (9) ...to here | | (10) calling 'ublk_submit_cmd' from 'ublk_queue_cmd' | +--> 'ublk_submit_cmd': events 11-12 | | 806 | static void ublk_submit_cmd(struct ublk_queue *ubq, const struct request *rq) | | ^~~~~~~~~~~~~~~ | | | | | (11) entry to 'ublk_submit_cmd' | 807 | { | 808 | struct ublk_io *io = &ubq->ios[rq->tag]; | | ~~~~~~~ | | | | | (12) dereference of NULL 'rq' | drivers/block/ublk_drv.c: In function 'ublk_ctrl_uring_cmd_permission': >> drivers/block/ublk_drv.c:2107:15: warning: use of uninitialized value 'mask' [CWE-457] [-Wanalyzer-use-of-uninitialized-value] 2107 | ret = ublk_char_dev_permission(ub, dev_path, mask); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 'ublk_ctrl_uring_cmd_permission': events 1-12 | | 2051 | int mask; | | ^~~~ | | | | | (1) region created on stack here |...... | 2072 | if (!header->dev_path_len || header->dev_path_len > PATH_MAX) | | ~ | | | | | (2) following 'false' branch... |...... | 2075 | if (header->len < header->dev_path_len) | | ~~ ~ | | | | | | | (4) following 'false' branch... | | (3) ...to here |...... | 2078 | dev_path = kmalloc(header->dev_path_len, GFP_KERNEL); | | ~~~~~~~~ | | | | | (5) ...to here | 2079 | if (!dev_path) | | ~ | | | | | (6) following 'false' branch... |...... | 2082 | ret = -EFAULT; | | ~~~ | | | | | (7) ...to here | 2083 | if (copy_from_user(dev_path, argp, header->dev_path_len)) | | ~ | | | | | (8) following 'false' branch (when 'n == 0')... | 2084 | goto exit; | 2085 | dev_path[header->dev_path_len] = 0; | | ~~~~~~~~ | | | | | (9) ...to here | 2086 | | 2087 | switch (cmd->cmd_op) { | | ~~~~~~ | | | | | (10) following 'default:' branch... |...... | 2107 | ret = ublk_char_dev_permission(ub, dev_path, mask); | | ~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | | | (12) use of uninitialized value 'mask' here | | (11) ...to here | >> drivers/block/ublk_drv.c:2107:15: warning: use of uninitialized value 'mask' [CWE-457] [-Wanalyzer-use-of-uninitialized-value] 2107 | ret = ublk_char_dev_permission(ub, dev_path, mask); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 'ublk_ctrl_uring_cmd': events 1-6 | | 2121 | static int ublk_ctrl_uring_cmd(struct io_uring_cmd *cmd, | | ^~~~~~~~~~~~~~~~~~~ | | | | | (1) entry to 'ublk_ctrl_uring_cmd' |...... | 2130 | if (!(issue_flags & IO_URING_F_SQE128)) | | ~ | | | | | (2) following 'false' branch... |...... | 2133 | if (cmd->cmd_op != UBLK_CMD_ADD_DEV) { | | ~~ ~ | | | | | | | (4) following 'true' branch... | | (3) ...to here | 2134 | ret = -ENODEV; | | ~~~ | | | | | (5) ...to here | 2135 | ub = ublk_get_device_from_id(header->dev_id); | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (6) calling 'ublk_get_device_from_id' from 'ublk_ctrl_uring_cmd' | +--> 'ublk_get_device_from_id': events 7-13 | | 310 | if (kobject_get_unless_zero(&ub->cdev_dev.kobj)) | | ~ | | | | | (12) following 'true' branch... |...... | 1512 | static struct ublk_device *ublk_get_device_from_id(int idx) | | ^~~~~~~~~~~~~~~~~~~~~~~ | | | | | (7) entry to 'ublk_get_device_from_id' |...... | 1516 | if (idx < 0) | | ~ | | | | | (8) following 'false' branch (when 'idx >= 0')... |...... | 1519 | spin_lock(&ublk_idr_lock); | | ~~~~~~~~~ | | | | | (9) ...to here | 1520 | ub = idr_find(&ublk_index_idr, idx); | 1521 | if (ub) | | ~ | | | | | (10) following 'true' branch (when 'ub' is non-NULL)... | 1522 | ub = ublk_get_device(ub); | | ~~ ~~~~~~~~~~~~~~~~~~~ | | | | | | | (13) ...to here | | (11) ...to here | <------+ | 'ublk_ctrl_uring_cmd': events 14-17 | | 2135 | ub = ublk_get_device_from_id(header->dev_id); | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (14) returning to 'ublk_ctrl_uring_cmd' from 'ublk_get_device_from_id' | 2136 | if (!ub) | | ~ | | | | | (15) following 'false' branch... |...... | 2139 | ret = ublk_ctrl_uring_cmd_permission(ub, cmd); | | ~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | | | (17) calling 'ublk_ctrl_uring_cmd_permission' from 'ublk_ctrl_uring_cmd' | | (16) ...to here | +--> 'ublk_ctrl_uring_cmd_permission': events 18-30 | | 2043 | static int ublk_ctrl_uring_cmd_permission(struct ublk_device *ub, | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (18) entry to 'ublk_ctrl_uring_cmd_permission' |...... | 2051 | int mask; | | ~~~~ | | | | | (19) region created on stack here |...... | 2072 | if (!header->dev_path_len || header->dev_path_len > PATH_MAX) | | ~ | | | | | (20) following 'false' branch... |...... | 2075 | if (header->len < header->dev_path_len) | | ~~ ~ | | | | | | | (22) following 'false' branch... vim +/mask +2107 drivers/block/ublk_drv.c a922b5da71a777 Ming Lei 2022-11-16 2042 a922b5da71a777 Ming Lei 2022-11-16 2043 static int ublk_ctrl_uring_cmd_permission(struct ublk_device *ub, a922b5da71a777 Ming Lei 2022-11-16 2044 struct io_uring_cmd *cmd) a922b5da71a777 Ming Lei 2022-11-16 2045 { a922b5da71a777 Ming Lei 2022-11-16 2046 struct ublksrv_ctrl_cmd *header = (struct ublksrv_ctrl_cmd *)cmd->cmd; a922b5da71a777 Ming Lei 2022-11-16 2047 bool unprivileged = ub->dev_info.flags & UBLK_F_UNPRIVILEGED_DEV; a922b5da71a777 Ming Lei 2022-11-16 2048 void __user *argp = (void __user *)(unsigned long)header->addr; a922b5da71a777 Ming Lei 2022-11-16 2049 char *dev_path = NULL; a922b5da71a777 Ming Lei 2022-11-16 2050 int ret = 0; a922b5da71a777 Ming Lei 2022-11-16 2051 int mask; a922b5da71a777 Ming Lei 2022-11-16 2052 a922b5da71a777 Ming Lei 2022-11-16 2053 if (!unprivileged) { a922b5da71a777 Ming Lei 2022-11-16 2054 if (!capable(CAP_SYS_ADMIN)) a922b5da71a777 Ming Lei 2022-11-16 2055 return -EPERM; a922b5da71a777 Ming Lei 2022-11-16 2056 /* a922b5da71a777 Ming Lei 2022-11-16 2057 * The new added command of UBLK_CMD_GET_DEV_INFO2 includes a922b5da71a777 Ming Lei 2022-11-16 2058 * char_dev_path in payload too, since userspace may not a922b5da71a777 Ming Lei 2022-11-16 2059 * know if the specified device is created as unprivileged a922b5da71a777 Ming Lei 2022-11-16 2060 * mode. a922b5da71a777 Ming Lei 2022-11-16 2061 */ a922b5da71a777 Ming Lei 2022-11-16 2062 if (cmd->cmd_op != UBLK_CMD_GET_DEV_INFO2) a922b5da71a777 Ming Lei 2022-11-16 2063 return 0; a922b5da71a777 Ming Lei 2022-11-16 2064 } a922b5da71a777 Ming Lei 2022-11-16 2065 a922b5da71a777 Ming Lei 2022-11-16 2066 /* a922b5da71a777 Ming Lei 2022-11-16 2067 * User has to provide the char device path for unprivileged ublk a922b5da71a777 Ming Lei 2022-11-16 2068 * a922b5da71a777 Ming Lei 2022-11-16 2069 * header->addr always points to the dev path buffer, and a922b5da71a777 Ming Lei 2022-11-16 2070 * header->dev_path_len records length of dev path buffer. a922b5da71a777 Ming Lei 2022-11-16 2071 */ a922b5da71a777 Ming Lei 2022-11-16 2072 if (!header->dev_path_len || header->dev_path_len > PATH_MAX) a922b5da71a777 Ming Lei 2022-11-16 2073 return -EINVAL; a922b5da71a777 Ming Lei 2022-11-16 2074 a922b5da71a777 Ming Lei 2022-11-16 2075 if (header->len < header->dev_path_len) a922b5da71a777 Ming Lei 2022-11-16 2076 return -EINVAL; a922b5da71a777 Ming Lei 2022-11-16 2077 a922b5da71a777 Ming Lei 2022-11-16 2078 dev_path = kmalloc(header->dev_path_len, GFP_KERNEL); a922b5da71a777 Ming Lei 2022-11-16 2079 if (!dev_path) a922b5da71a777 Ming Lei 2022-11-16 2080 return -ENOMEM; a922b5da71a777 Ming Lei 2022-11-16 2081 a922b5da71a777 Ming Lei 2022-11-16 2082 ret = -EFAULT; a922b5da71a777 Ming Lei 2022-11-16 2083 if (copy_from_user(dev_path, argp, header->dev_path_len)) a922b5da71a777 Ming Lei 2022-11-16 2084 goto exit; a922b5da71a777 Ming Lei 2022-11-16 2085 dev_path[header->dev_path_len] = 0; a922b5da71a777 Ming Lei 2022-11-16 2086 a922b5da71a777 Ming Lei 2022-11-16 2087 switch (cmd->cmd_op) { a922b5da71a777 Ming Lei 2022-11-16 2088 case UBLK_CMD_GET_DEV_INFO: a922b5da71a777 Ming Lei 2022-11-16 2089 case UBLK_CMD_GET_DEV_INFO2: a922b5da71a777 Ming Lei 2022-11-16 2090 case UBLK_CMD_GET_QUEUE_AFFINITY: a922b5da71a777 Ming Lei 2022-11-16 2091 case UBLK_CMD_GET_PARAMS: a922b5da71a777 Ming Lei 2022-11-16 2092 mask = MAY_READ; a922b5da71a777 Ming Lei 2022-11-16 2093 break; a922b5da71a777 Ming Lei 2022-11-16 2094 case UBLK_CMD_START_DEV: a922b5da71a777 Ming Lei 2022-11-16 2095 case UBLK_CMD_STOP_DEV: a922b5da71a777 Ming Lei 2022-11-16 2096 case UBLK_CMD_ADD_DEV: a922b5da71a777 Ming Lei 2022-11-16 2097 case UBLK_CMD_DEL_DEV: a922b5da71a777 Ming Lei 2022-11-16 2098 case UBLK_CMD_SET_PARAMS: a922b5da71a777 Ming Lei 2022-11-16 2099 case UBLK_CMD_START_USER_RECOVERY: a922b5da71a777 Ming Lei 2022-11-16 2100 case UBLK_CMD_END_USER_RECOVERY: a922b5da71a777 Ming Lei 2022-11-16 2101 mask = MAY_READ | MAY_WRITE; a922b5da71a777 Ming Lei 2022-11-16 2102 break; a922b5da71a777 Ming Lei 2022-11-16 2103 default: a922b5da71a777 Ming Lei 2022-11-16 2104 break; a922b5da71a777 Ming Lei 2022-11-16 2105 } a922b5da71a777 Ming Lei 2022-11-16 2106 a922b5da71a777 Ming Lei 2022-11-16 @2107 ret = ublk_char_dev_permission(ub, dev_path, mask); a922b5da71a777 Ming Lei 2022-11-16 2108 if (!ret) { a922b5da71a777 Ming Lei 2022-11-16 2109 header->len -= header->dev_path_len; a922b5da71a777 Ming Lei 2022-11-16 2110 header->addr += header->dev_path_len; a922b5da71a777 Ming Lei 2022-11-16 2111 } a922b5da71a777 Ming Lei 2022-11-16 2112 pr_devel("%s: dev id %d cmd_op %x uid %d gid %d path %s ret %d\n", a922b5da71a777 Ming Lei 2022-11-16 2113 __func__, ub->ub_number, cmd->cmd_op, a922b5da71a777 Ming Lei 2022-11-16 2114 ub->dev_info.owner_uid, ub->dev_info.owner_gid, a922b5da71a777 Ming Lei 2022-11-16 2115 dev_path, ret); a922b5da71a777 Ming Lei 2022-11-16 2116 exit: a922b5da71a777 Ming Lei 2022-11-16 2117 kfree(dev_path); a922b5da71a777 Ming Lei 2022-11-16 2118 return ret; a922b5da71a777 Ming Lei 2022-11-16 2119 } a922b5da71a777 Ming Lei 2022-11-16 2120 -- 0-DAY CI Kernel Test Service https://01.org/lkp