From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: Re: [PATCH -next 1/3] cgroup/dmem: fix NULL pointer dereference when setting max
Date: Sun, 1 Feb 2026 15:38:15 +0800 [thread overview]
Message-ID: <202602011549.IiweIsR6-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
In-Reply-To: <20260131091202.344788-2-chenridong@huaweicloud.com>
References: <20260131091202.344788-2-chenridong@huaweicloud.com>
TO: Chen Ridong <chenridong@huaweicloud.com>
TO: dev@lankhorst.se
TO: mripard@kernel.org
TO: natalie.vock@gmx.de
TO: tj@kernel.org
TO: hannes@cmpxchg.org
TO: mkoutny@suse.com
CC: cgroups@vger.kernel.org
CC: dri-devel@lists.freedesktop.org
CC: linux-kernel@vger.kernel.org
CC: lujialin4@huawei.com
CC: chenridong@huaweicloud.com
Hi Chen,
kernel test robot noticed the following build warnings:
[auto build test WARNING on next-20260130]
url: https://github.com/intel-lab-lkp/linux/commits/Chen-Ridong/cgroup-dmem-fix-NULL-pointer-dereference-when-setting-max/20260131-173002
base: next-20260130
patch link: https://lore.kernel.org/r/20260131091202.344788-2-chenridong%40huaweicloud.com
patch subject: [PATCH -next 1/3] cgroup/dmem: fix NULL pointer dereference when setting max
:::::: branch date: 22 hours ago
:::::: commit date: 22 hours ago
config: x86_64-randconfig-161-20260201 (https://download.01.org/0day-ci/archive/20260201/202602011549.IiweIsR6-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch version: v0.5.0-8994-gd50c5a4c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202602011549.IiweIsR6-lkp@intel.com/
smatch warnings:
kernel/cgroup/dmem.c:703 dmemcg_limit_write() warn: variable dereferenced before check 'options' (see line 696)
vim +/options +703 kernel/cgroup/dmem.c
b168ed458ddecc Maarten Lankhorst 2024-12-04 674
b168ed458ddecc Maarten Lankhorst 2024-12-04 675 static ssize_t dmemcg_limit_write(struct kernfs_open_file *of,
b168ed458ddecc Maarten Lankhorst 2024-12-04 676 char *buf, size_t nbytes, loff_t off,
b168ed458ddecc Maarten Lankhorst 2024-12-04 677 void (*apply)(struct dmem_cgroup_pool_state *, u64))
b168ed458ddecc Maarten Lankhorst 2024-12-04 678 {
b168ed458ddecc Maarten Lankhorst 2024-12-04 679 struct dmemcg_state *dmemcs = css_to_dmemcs(of_css(of));
b168ed458ddecc Maarten Lankhorst 2024-12-04 680 int err = 0;
b168ed458ddecc Maarten Lankhorst 2024-12-04 681
b168ed458ddecc Maarten Lankhorst 2024-12-04 682 while (buf && !err) {
b168ed458ddecc Maarten Lankhorst 2024-12-04 683 struct dmem_cgroup_pool_state *pool = NULL;
b168ed458ddecc Maarten Lankhorst 2024-12-04 684 char *options, *region_name;
b168ed458ddecc Maarten Lankhorst 2024-12-04 685 struct dmem_cgroup_region *region;
b168ed458ddecc Maarten Lankhorst 2024-12-04 686 u64 new_limit;
b168ed458ddecc Maarten Lankhorst 2024-12-04 687
b168ed458ddecc Maarten Lankhorst 2024-12-04 688 options = buf;
b168ed458ddecc Maarten Lankhorst 2024-12-04 689 buf = strchr(buf, '\n');
b168ed458ddecc Maarten Lankhorst 2024-12-04 690 if (buf)
b168ed458ddecc Maarten Lankhorst 2024-12-04 691 *buf++ = '\0';
b168ed458ddecc Maarten Lankhorst 2024-12-04 692
b168ed458ddecc Maarten Lankhorst 2024-12-04 693 options = strstrip(options);
b168ed458ddecc Maarten Lankhorst 2024-12-04 694
b168ed458ddecc Maarten Lankhorst 2024-12-04 695 /* eat empty lines */
b168ed458ddecc Maarten Lankhorst 2024-12-04 @696 if (!options[0])
b168ed458ddecc Maarten Lankhorst 2024-12-04 697 continue;
b168ed458ddecc Maarten Lankhorst 2024-12-04 698
b168ed458ddecc Maarten Lankhorst 2024-12-04 699 region_name = strsep(&options, " \t");
b168ed458ddecc Maarten Lankhorst 2024-12-04 700 if (!region_name[0])
b168ed458ddecc Maarten Lankhorst 2024-12-04 701 continue;
b168ed458ddecc Maarten Lankhorst 2024-12-04 702
7b9767ec21ff41 Chen Ridong 2026-01-31 @703 if (!options || !*options) {
7b9767ec21ff41 Chen Ridong 2026-01-31 704 err = -EINVAL;
7b9767ec21ff41 Chen Ridong 2026-01-31 705 goto out_put;
7b9767ec21ff41 Chen Ridong 2026-01-31 706 }
7b9767ec21ff41 Chen Ridong 2026-01-31 707
b168ed458ddecc Maarten Lankhorst 2024-12-04 708 rcu_read_lock();
b168ed458ddecc Maarten Lankhorst 2024-12-04 709 region = dmemcg_get_region_by_name(region_name);
b168ed458ddecc Maarten Lankhorst 2024-12-04 710 rcu_read_unlock();
b168ed458ddecc Maarten Lankhorst 2024-12-04 711
b168ed458ddecc Maarten Lankhorst 2024-12-04 712 if (!region)
b168ed458ddecc Maarten Lankhorst 2024-12-04 713 return -EINVAL;
b168ed458ddecc Maarten Lankhorst 2024-12-04 714
b168ed458ddecc Maarten Lankhorst 2024-12-04 715 err = dmemcg_parse_limit(options, region, &new_limit);
b168ed458ddecc Maarten Lankhorst 2024-12-04 716 if (err < 0)
b168ed458ddecc Maarten Lankhorst 2024-12-04 717 goto out_put;
b168ed458ddecc Maarten Lankhorst 2024-12-04 718
b168ed458ddecc Maarten Lankhorst 2024-12-04 719 pool = get_cg_pool_unlocked(dmemcs, region);
b168ed458ddecc Maarten Lankhorst 2024-12-04 720 if (IS_ERR(pool)) {
b168ed458ddecc Maarten Lankhorst 2024-12-04 721 err = PTR_ERR(pool);
b168ed458ddecc Maarten Lankhorst 2024-12-04 722 goto out_put;
b168ed458ddecc Maarten Lankhorst 2024-12-04 723 }
b168ed458ddecc Maarten Lankhorst 2024-12-04 724
b168ed458ddecc Maarten Lankhorst 2024-12-04 725 /* And commit */
b168ed458ddecc Maarten Lankhorst 2024-12-04 726 apply(pool, new_limit);
b168ed458ddecc Maarten Lankhorst 2024-12-04 727
b168ed458ddecc Maarten Lankhorst 2024-12-04 728 out_put:
b168ed458ddecc Maarten Lankhorst 2024-12-04 729 kref_put(®ion->ref, dmemcg_free_region);
b168ed458ddecc Maarten Lankhorst 2024-12-04 730 }
b168ed458ddecc Maarten Lankhorst 2024-12-04 731
b168ed458ddecc Maarten Lankhorst 2024-12-04 732
b168ed458ddecc Maarten Lankhorst 2024-12-04 733 return err ?: nbytes;
b168ed458ddecc Maarten Lankhorst 2024-12-04 734 }
b168ed458ddecc Maarten Lankhorst 2024-12-04 735
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-02-01 7:38 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-01 7:38 kernel test robot [this message]
-- strict thread matches above, loose matches on Subject: below --
2026-01-31 9:11 [PATCH -next 0/3] cgroup/dmem: bugfixes Chen Ridong
2026-01-31 9:12 ` [PATCH -next 1/3] cgroup/dmem: fix NULL pointer dereference when setting max Chen Ridong
2026-01-31 17:26 ` kernel test robot
2026-02-02 0:50 ` Chen Ridong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202602011549.IiweIsR6-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.