From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [android-common:android13-5.10 1/1] fs/f2fs/iostat.c:210 __update_iostat_latency() error: buffer overflow 'io_lat->sum_lat[idx]' 3 <= 3
Date: Tue, 27 Jan 2026 21:03:43 +0800 [thread overview]
Message-ID: <202601272004.HnjloZC4-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: cros-kernel-buildreports@googlegroups.com
tree: https://android.googlesource.com/kernel/common android13-5.10
head: 8b96c137bec0cc9c414f85dc958b9a5785a0790f
commit: d95bf22a4d1cbeebc288b87af27f0ea181a57218 [1/1] f2fs: introduce periodic iostat io latency traces
:::::: branch date: 16 hours ago
:::::: commit date: 4 years, 5 months ago
config: x86_64-randconfig-161-20260126 (https://download.01.org/0day-ci/archive/20260127/202601272004.HnjloZC4-lkp@intel.com/config)
compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9b8addffa70cee5b2acc5454712d9cf78ce45710)
smatch version: v0.5.0-8994-gd50c5a4c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202601272004.HnjloZC4-lkp@intel.com/
New smatch warnings:
fs/f2fs/iostat.c:210 __update_iostat_latency() error: buffer overflow 'io_lat->sum_lat[idx]' 3 <= 3
fs/f2fs/iostat.c:211 __update_iostat_latency() error: buffer overflow 'io_lat->bio_cnt[idx]' 3 <= 3
fs/f2fs/iostat.c:212 __update_iostat_latency() error: buffer overflow 'io_lat->peak_lat[idx]' 3 <= 3
Old smatch warnings:
fs/f2fs/iostat.c:213 __update_iostat_latency() error: buffer overflow 'io_lat->peak_lat[idx]' 3 <= 3
vim +210 fs/f2fs/iostat.c
d20508aceea564 Daeho Jeong 2021-08-19 182
d95bf22a4d1cbe Daeho Jeong 2021-08-20 183 static inline void __update_iostat_latency(struct bio_iostat_ctx *iostat_ctx,
d95bf22a4d1cbe Daeho Jeong 2021-08-20 184 int rw, bool is_sync)
d95bf22a4d1cbe Daeho Jeong 2021-08-20 185 {
d95bf22a4d1cbe Daeho Jeong 2021-08-20 186 unsigned long ts_diff;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 187 unsigned int iotype = iostat_ctx->type;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 188 unsigned long flags;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 189 struct f2fs_sb_info *sbi = iostat_ctx->sbi;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 190 struct iostat_lat_info *io_lat = sbi->iostat_io_lat;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 191 int idx;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 192
d95bf22a4d1cbe Daeho Jeong 2021-08-20 193 if (!sbi->iostat_enable)
d95bf22a4d1cbe Daeho Jeong 2021-08-20 194 return;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 195
d95bf22a4d1cbe Daeho Jeong 2021-08-20 196 ts_diff = jiffies - iostat_ctx->submit_ts;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 197 if (iotype >= META_FLUSH)
d95bf22a4d1cbe Daeho Jeong 2021-08-20 198 iotype = META;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 199
d95bf22a4d1cbe Daeho Jeong 2021-08-20 200 if (rw == 0) {
d95bf22a4d1cbe Daeho Jeong 2021-08-20 201 idx = READ_IO;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 202 } else {
d95bf22a4d1cbe Daeho Jeong 2021-08-20 203 if (is_sync)
d95bf22a4d1cbe Daeho Jeong 2021-08-20 204 idx = WRITE_SYNC_IO;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 205 else
d95bf22a4d1cbe Daeho Jeong 2021-08-20 206 idx = WRITE_ASYNC_IO;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 207 }
d95bf22a4d1cbe Daeho Jeong 2021-08-20 208
d95bf22a4d1cbe Daeho Jeong 2021-08-20 209 spin_lock_irqsave(&sbi->iostat_lat_lock, flags);
d95bf22a4d1cbe Daeho Jeong 2021-08-20 @210 io_lat->sum_lat[idx][iotype] += ts_diff;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 @211 io_lat->bio_cnt[idx][iotype]++;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 @212 if (ts_diff > io_lat->peak_lat[idx][iotype])
d95bf22a4d1cbe Daeho Jeong 2021-08-20 213 io_lat->peak_lat[idx][iotype] = ts_diff;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 214 spin_unlock_irqrestore(&sbi->iostat_lat_lock, flags);
d95bf22a4d1cbe Daeho Jeong 2021-08-20 215 }
d95bf22a4d1cbe Daeho Jeong 2021-08-20 216
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@linaro.org>
To: oe-kbuild@lists.linux.dev, cros-kernel-buildreports@googlegroups.com
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev
Subject: [android-common:android13-5.10 1/1] fs/f2fs/iostat.c:210 __update_iostat_latency() error: buffer overflow 'io_lat->sum_lat[idx]' 3 <= 3
Date: Wed, 28 Jan 2026 14:29:05 +0300 [thread overview]
Message-ID: <202601272004.HnjloZC4-lkp@intel.com> (raw)
Message-ID: <20260128112905.itDVBedCzGY-hIe3rm-8GywTm-k4CuNnaNOFfrtMUj4@z> (raw)
tree: https://android.googlesource.com/kernel/common android13-5.10
head: 8b96c137bec0cc9c414f85dc958b9a5785a0790f
commit: d95bf22a4d1cbeebc288b87af27f0ea181a57218 [1/1] f2fs: introduce periodic iostat io latency traces
config: x86_64-randconfig-161-20260126 (https://download.01.org/0day-ci/archive/20260127/202601272004.HnjloZC4-lkp@intel.com/config)
compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9b8addffa70cee5b2acc5454712d9cf78ce45710)
smatch version: v0.5.0-8994-gd50c5a4c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202601272004.HnjloZC4-lkp@intel.com/
New smatch warnings:
fs/f2fs/iostat.c:210 __update_iostat_latency() error: buffer overflow 'io_lat->sum_lat[idx]' 3 <= 3
fs/f2fs/iostat.c:211 __update_iostat_latency() error: buffer overflow 'io_lat->bio_cnt[idx]' 3 <= 3
fs/f2fs/iostat.c:212 __update_iostat_latency() error: buffer overflow 'io_lat->peak_lat[idx]' 3 <= 3
Old smatch warnings:
fs/f2fs/iostat.c:213 __update_iostat_latency() error: buffer overflow 'io_lat->peak_lat[idx]' 3 <= 3
vim +210 fs/f2fs/iostat.c
d95bf22a4d1cbe Daeho Jeong 2021-08-20 183 static inline void __update_iostat_latency(struct bio_iostat_ctx *iostat_ctx,
d95bf22a4d1cbe Daeho Jeong 2021-08-20 184 int rw, bool is_sync)
d95bf22a4d1cbe Daeho Jeong 2021-08-20 185 {
d95bf22a4d1cbe Daeho Jeong 2021-08-20 186 unsigned long ts_diff;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 187 unsigned int iotype = iostat_ctx->type;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 188 unsigned long flags;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 189 struct f2fs_sb_info *sbi = iostat_ctx->sbi;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 190 struct iostat_lat_info *io_lat = sbi->iostat_io_lat;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 191 int idx;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 192
d95bf22a4d1cbe Daeho Jeong 2021-08-20 193 if (!sbi->iostat_enable)
d95bf22a4d1cbe Daeho Jeong 2021-08-20 194 return;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 195
d95bf22a4d1cbe Daeho Jeong 2021-08-20 196 ts_diff = jiffies - iostat_ctx->submit_ts;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 197 if (iotype >= META_FLUSH)
Should this be NR_PAGE_TYPE? The check is off by one.
d95bf22a4d1cbe Daeho Jeong 2021-08-20 198 iotype = META;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 199
d95bf22a4d1cbe Daeho Jeong 2021-08-20 200 if (rw == 0) {
d95bf22a4d1cbe Daeho Jeong 2021-08-20 201 idx = READ_IO;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 202 } else {
d95bf22a4d1cbe Daeho Jeong 2021-08-20 203 if (is_sync)
d95bf22a4d1cbe Daeho Jeong 2021-08-20 204 idx = WRITE_SYNC_IO;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 205 else
d95bf22a4d1cbe Daeho Jeong 2021-08-20 206 idx = WRITE_ASYNC_IO;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 207 }
d95bf22a4d1cbe Daeho Jeong 2021-08-20 208
d95bf22a4d1cbe Daeho Jeong 2021-08-20 209 spin_lock_irqsave(&sbi->iostat_lat_lock, flags);
d95bf22a4d1cbe Daeho Jeong 2021-08-20 @210 io_lat->sum_lat[idx][iotype] += ts_diff;
Out of bounds if iotype is NR_PAGE_TYPE.
d95bf22a4d1cbe Daeho Jeong 2021-08-20 @211 io_lat->bio_cnt[idx][iotype]++;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 @212 if (ts_diff > io_lat->peak_lat[idx][iotype])
d95bf22a4d1cbe Daeho Jeong 2021-08-20 213 io_lat->peak_lat[idx][iotype] = ts_diff;
d95bf22a4d1cbe Daeho Jeong 2021-08-20 214 spin_unlock_irqrestore(&sbi->iostat_lat_lock, flags);
d95bf22a4d1cbe Daeho Jeong 2021-08-20 215 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-01-27 13:04 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-27 13:03 kernel test robot [this message]
2026-01-28 11:29 ` [android-common:android13-5.10 1/1] fs/f2fs/iostat.c:210 __update_iostat_latency() error: buffer overflow 'io_lat->sum_lat[idx]' 3 <= 3 Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202601272004.HnjloZC4-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.