From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [linux-next:master 4172/4394] drivers/block/loop.c:413 lo_rw_aio() error: we previously assumed 'file' could be null (see line 400)
Date: Sat, 09 May 2026 20:56:05 +0800 [thread overview]
Message-ID: <202605092030.FAH71Jou-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head: e98d21c170b01ddef366f023bbfcf6b31509fa83
commit: 1a83d226268cfb9ea546febe6515f39584df8fd2 [4172/4394] loop: check refcount in __loop_clr_fd() and lo_rw_aio()
:::::: branch date: 24 hours ago
:::::: commit date: 2 days ago
config: m68k-randconfig-r073-20260509 (https://download.01.org/0day-ci/archive/20260509/202605092030.FAH71Jou-lkp@intel.com/config)
compiler: m68k-linux-gcc (GCC) 12.5.0
smatch: v0.5.0-9065-ge9cc34fd
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202605092030.FAH71Jou-lkp@intel.com/
New smatch warnings:
drivers/block/loop.c:413 lo_rw_aio() error: we previously assumed 'file' could be null (see line 400)
Old smatch warnings:
drivers/block/loop.c:676 loop_attr_backing_file_show() warn: passing zero to 'PTR_ERR'
vim +/file +413 drivers/block/loop.c
bc07c10a3603a5 Ming Lei 2015-08-17 339
96f03c8cb29f2e Jens Axboe 2025-11-24 340 static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd,
96f03c8cb29f2e Jens Axboe 2025-11-24 341 loff_t pos, int rw)
c3e6c11147f6f0 Ming Lei 2025-10-15 342 {
96f03c8cb29f2e Jens Axboe 2025-11-24 343 struct iov_iter iter;
c3e6c11147f6f0 Ming Lei 2025-10-15 344 struct req_iterator rq_iter;
96f03c8cb29f2e Jens Axboe 2025-11-24 345 struct bio_vec *bvec;
96f03c8cb29f2e Jens Axboe 2025-11-24 346 struct request *rq = blk_mq_rq_from_pdu(cmd);
96f03c8cb29f2e Jens Axboe 2025-11-24 347 struct bio *bio = rq->bio;
96f03c8cb29f2e Jens Axboe 2025-11-24 348 struct file *file = lo->lo_backing_file;
c3e6c11147f6f0 Ming Lei 2025-10-15 349 struct bio_vec tmp;
96f03c8cb29f2e Jens Axboe 2025-11-24 350 unsigned int offset;
71075d25ca5cae Chaitanya Kulkarni 2025-12-02 351 unsigned int nr_bvec;
96f03c8cb29f2e Jens Axboe 2025-11-24 352 int ret;
c3e6c11147f6f0 Ming Lei 2025-10-15 353
71075d25ca5cae Chaitanya Kulkarni 2025-12-02 354 nr_bvec = blk_rq_nr_bvec(rq);
c3e6c11147f6f0 Ming Lei 2025-10-15 355
40326d8a33d5b7 Shaohua Li 2017-08-31 356 if (rq->bio != rq->biotail) {
bc07c10a3603a5 Ming Lei 2015-08-17 357
69050f8d6d075d Kees Cook 2026-02-20 358 bvec = kmalloc_objs(struct bio_vec, nr_bvec, GFP_NOIO);
40326d8a33d5b7 Shaohua Li 2017-08-31 359 if (!bvec)
40326d8a33d5b7 Shaohua Li 2017-08-31 360 return -EIO;
40326d8a33d5b7 Shaohua Li 2017-08-31 361 cmd->bvec = bvec;
40326d8a33d5b7 Shaohua Li 2017-08-31 362
40326d8a33d5b7 Shaohua Li 2017-08-31 363 /*
40326d8a33d5b7 Shaohua Li 2017-08-31 364 * The bios of the request may be started from the middle of
40326d8a33d5b7 Shaohua Li 2017-08-31 365 * the 'bvec' because of bio splitting, so we can't directly
86af5952a8470f Ming Lei 2019-02-15 366 * copy bio->bi_iov_vec to new bvec. The rq_for_each_bvec
40326d8a33d5b7 Shaohua Li 2017-08-31 367 * API will take care of all details for us.
40326d8a33d5b7 Shaohua Li 2017-08-31 368 */
86af5952a8470f Ming Lei 2019-02-15 369 rq_for_each_bvec(tmp, rq, rq_iter) {
40326d8a33d5b7 Shaohua Li 2017-08-31 370 *bvec = tmp;
40326d8a33d5b7 Shaohua Li 2017-08-31 371 bvec++;
40326d8a33d5b7 Shaohua Li 2017-08-31 372 }
96f03c8cb29f2e Jens Axboe 2025-11-24 373 bvec = cmd->bvec;
96f03c8cb29f2e Jens Axboe 2025-11-24 374 offset = 0;
fd858d1ca9694c Ming Lei 2025-10-15 375 } else {
96f03c8cb29f2e Jens Axboe 2025-11-24 376 /*
96f03c8cb29f2e Jens Axboe 2025-11-24 377 * Same here, this bio may be started from the middle of the
96f03c8cb29f2e Jens Axboe 2025-11-24 378 * 'bvec' because of bio splitting, so offset from the bvec
96f03c8cb29f2e Jens Axboe 2025-11-24 379 * must be passed to iov iterator
96f03c8cb29f2e Jens Axboe 2025-11-24 380 */
96f03c8cb29f2e Jens Axboe 2025-11-24 381 offset = bio->bi_iter.bi_bvec_done;
96f03c8cb29f2e Jens Axboe 2025-11-24 382 bvec = __bvec_iter_bvec(bio->bi_io_vec, bio->bi_iter);
fd858d1ca9694c Ming Lei 2025-10-15 383 }
96f03c8cb29f2e Jens Axboe 2025-11-24 384 atomic_set(&cmd->ref, 2);
96f03c8cb29f2e Jens Axboe 2025-11-24 385
96f03c8cb29f2e Jens Axboe 2025-11-24 386 iov_iter_bvec(&iter, rw, bvec, nr_bvec, blk_rq_bytes(rq));
96f03c8cb29f2e Jens Axboe 2025-11-24 387 iter.iov_offset = offset;
fd858d1ca9694c Ming Lei 2025-10-15 388
fd858d1ca9694c Ming Lei 2025-10-15 389 cmd->iocb.ki_pos = pos;
96f03c8cb29f2e Jens Axboe 2025-11-24 390 cmd->iocb.ki_filp = file;
fd858d1ca9694c Ming Lei 2025-10-15 391 cmd->iocb.ki_ioprio = req_get_ioprio(rq);
fd858d1ca9694c Ming Lei 2025-10-15 392 if (cmd->use_aio) {
fd858d1ca9694c Ming Lei 2025-10-15 393 cmd->iocb.ki_complete = lo_rw_aio_complete;
fd858d1ca9694c Ming Lei 2025-10-15 394 cmd->iocb.ki_flags = IOCB_DIRECT;
fd858d1ca9694c Ming Lei 2025-10-15 395 } else {
fd858d1ca9694c Ming Lei 2025-10-15 396 cmd->iocb.ki_complete = NULL;
fd858d1ca9694c Ming Lei 2025-10-15 397 cmd->iocb.ki_flags = 0;
fd858d1ca9694c Ming Lei 2025-10-15 398 }
bc07c10a3603a5 Ming Lei 2015-08-17 399
1a83d226268cfb Tetsuo Handa 2026-05-08 @400 if (!file)
1a83d226268cfb Tetsuo Handa 2026-05-08 401 pr_err("%s(loop%d) starting %s with NULL file (already cleared?)\n",
1a83d226268cfb Tetsuo Handa 2026-05-08 402 __func__, lo->lo_number, rw == ITER_SOURCE ? "write" : "read");
1a83d226268cfb Tetsuo Handa 2026-05-08 403 else if (!file_count(file))
1a83d226268cfb Tetsuo Handa 2026-05-08 404 pr_err("%s(loop%d) starting %s with raw_refcnt=0x%lx (already released?)\n",
1a83d226268cfb Tetsuo Handa 2026-05-08 405 __func__, lo->lo_number, rw == ITER_SOURCE ? "write" : "read",
1a83d226268cfb Tetsuo Handa 2026-05-08 406 __file_ref_read_raw(&file->f_ref));
1a83d226268cfb Tetsuo Handa 2026-05-08 407 else if (IS_ENABLED(CONFIG_DEBUG_AID_FOR_SYZBOT))
1a83d226268cfb Tetsuo Handa 2026-05-08 408 pr_info("%s(loop%d) starting %s with raw_refcnt=0x%lx, refcnt=%lu\n",
1a83d226268cfb Tetsuo Handa 2026-05-08 409 __func__, lo->lo_number, rw == ITER_SOURCE ? "write" : "read",
1a83d226268cfb Tetsuo Handa 2026-05-08 410 __file_ref_read_raw(&file->f_ref), file_count(file));
39d86db34e41b9 Ming Lei 2025-05-27 411 if (rw == ITER_SOURCE) {
c4706c5058a7bd Ming Lei 2025-07-16 412 kiocb_start_write(&cmd->iocb);
7c98f7cb8fda96 Miklos Szeredi 2023-08-28 @413 ret = file->f_op->write_iter(&cmd->iocb, &iter);
39d86db34e41b9 Ming Lei 2025-05-27 414 } else
7c98f7cb8fda96 Miklos Szeredi 2023-08-28 415 ret = file->f_op->read_iter(&cmd->iocb, &iter);
bc07c10a3603a5 Ming Lei 2015-08-17 416
92d773324b7edb Shaohua Li 2017-09-01 417 lo_rw_aio_do_completion(cmd);
92d773324b7edb Shaohua Li 2017-09-01 418
bc07c10a3603a5 Ming Lei 2015-08-17 419 if (ret != -EIOCBQUEUED)
6b19b766e8f077 Jens Axboe 2021-10-21 420 lo_rw_aio_complete(&cmd->iocb, ret);
f2fed441c69b92 Christoph Hellwig 2025-04-09 421 return -EIOCBQUEUED;
bc07c10a3603a5 Ming Lei 2015-08-17 422 }
bc07c10a3603a5 Ming Lei 2015-08-17 423
:::::: The code at line 413 was first introduced by commit
:::::: 7c98f7cb8fda964fbc60b9307ad35e94735fa35f remove call_{read,write}_iter() functions
:::::: TO: Miklos Szeredi <mszeredi@redhat.com>
:::::: CC: Al Viro <viro@zeniv.linux.org.uk>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <error27@gmail.com>
To: oe-kbuild@lists.linux.dev,
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev
Subject: [linux-next:master 4172/4394] drivers/block/loop.c:413 lo_rw_aio() error: we previously assumed 'file' could be null (see line 400)
Date: Sat, 9 May 2026 16:19:52 +0300 [thread overview]
Message-ID: <202605092030.FAH71Jou-lkp@intel.com> (raw)
Message-ID: <20260509131952.8auzlX4IEsT3BP7uxLhYEVbZjp46iWiZJ0fPoXmTjU4@z> (raw)
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head: e98d21c170b01ddef366f023bbfcf6b31509fa83
commit: 1a83d226268cfb9ea546febe6515f39584df8fd2 [4172/4394] loop: check refcount in __loop_clr_fd() and lo_rw_aio()
config: m68k-randconfig-r073-20260509 (https://download.01.org/0day-ci/archive/20260509/202605092030.FAH71Jou-lkp@intel.com/config)
compiler: m68k-linux-gcc (GCC) 12.5.0
smatch: v0.5.0-9065-ge9cc34fd
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202605092030.FAH71Jou-lkp@intel.com/
New smatch warnings:
drivers/block/loop.c:413 lo_rw_aio() error: we previously assumed 'file' could be null (see line 400)
vim +/file +413 drivers/block/loop.c
96f03c8cb29f2e Jens Axboe 2025-11-24 340 static int lo_rw_aio(struct loop_device *lo, struct loop_cmd *cmd,
96f03c8cb29f2e Jens Axboe 2025-11-24 341 loff_t pos, int rw)
c3e6c11147f6f0 Ming Lei 2025-10-15 342 {
96f03c8cb29f2e Jens Axboe 2025-11-24 343 struct iov_iter iter;
c3e6c11147f6f0 Ming Lei 2025-10-15 344 struct req_iterator rq_iter;
96f03c8cb29f2e Jens Axboe 2025-11-24 345 struct bio_vec *bvec;
96f03c8cb29f2e Jens Axboe 2025-11-24 346 struct request *rq = blk_mq_rq_from_pdu(cmd);
96f03c8cb29f2e Jens Axboe 2025-11-24 347 struct bio *bio = rq->bio;
96f03c8cb29f2e Jens Axboe 2025-11-24 348 struct file *file = lo->lo_backing_file;
c3e6c11147f6f0 Ming Lei 2025-10-15 349 struct bio_vec tmp;
96f03c8cb29f2e Jens Axboe 2025-11-24 350 unsigned int offset;
71075d25ca5cae Chaitanya Kulkarni 2025-12-02 351 unsigned int nr_bvec;
96f03c8cb29f2e Jens Axboe 2025-11-24 352 int ret;
c3e6c11147f6f0 Ming Lei 2025-10-15 353
71075d25ca5cae Chaitanya Kulkarni 2025-12-02 354 nr_bvec = blk_rq_nr_bvec(rq);
c3e6c11147f6f0 Ming Lei 2025-10-15 355
40326d8a33d5b7 Shaohua Li 2017-08-31 356 if (rq->bio != rq->biotail) {
bc07c10a3603a5 Ming Lei 2015-08-17 357
69050f8d6d075d Kees Cook 2026-02-20 358 bvec = kmalloc_objs(struct bio_vec, nr_bvec, GFP_NOIO);
40326d8a33d5b7 Shaohua Li 2017-08-31 359 if (!bvec)
40326d8a33d5b7 Shaohua Li 2017-08-31 360 return -EIO;
40326d8a33d5b7 Shaohua Li 2017-08-31 361 cmd->bvec = bvec;
40326d8a33d5b7 Shaohua Li 2017-08-31 362
40326d8a33d5b7 Shaohua Li 2017-08-31 363 /*
40326d8a33d5b7 Shaohua Li 2017-08-31 364 * The bios of the request may be started from the middle of
40326d8a33d5b7 Shaohua Li 2017-08-31 365 * the 'bvec' because of bio splitting, so we can't directly
86af5952a8470f Ming Lei 2019-02-15 366 * copy bio->bi_iov_vec to new bvec. The rq_for_each_bvec
40326d8a33d5b7 Shaohua Li 2017-08-31 367 * API will take care of all details for us.
40326d8a33d5b7 Shaohua Li 2017-08-31 368 */
86af5952a8470f Ming Lei 2019-02-15 369 rq_for_each_bvec(tmp, rq, rq_iter) {
40326d8a33d5b7 Shaohua Li 2017-08-31 370 *bvec = tmp;
40326d8a33d5b7 Shaohua Li 2017-08-31 371 bvec++;
40326d8a33d5b7 Shaohua Li 2017-08-31 372 }
96f03c8cb29f2e Jens Axboe 2025-11-24 373 bvec = cmd->bvec;
96f03c8cb29f2e Jens Axboe 2025-11-24 374 offset = 0;
fd858d1ca9694c Ming Lei 2025-10-15 375 } else {
96f03c8cb29f2e Jens Axboe 2025-11-24 376 /*
96f03c8cb29f2e Jens Axboe 2025-11-24 377 * Same here, this bio may be started from the middle of the
96f03c8cb29f2e Jens Axboe 2025-11-24 378 * 'bvec' because of bio splitting, so offset from the bvec
96f03c8cb29f2e Jens Axboe 2025-11-24 379 * must be passed to iov iterator
96f03c8cb29f2e Jens Axboe 2025-11-24 380 */
96f03c8cb29f2e Jens Axboe 2025-11-24 381 offset = bio->bi_iter.bi_bvec_done;
96f03c8cb29f2e Jens Axboe 2025-11-24 382 bvec = __bvec_iter_bvec(bio->bi_io_vec, bio->bi_iter);
fd858d1ca9694c Ming Lei 2025-10-15 383 }
96f03c8cb29f2e Jens Axboe 2025-11-24 384 atomic_set(&cmd->ref, 2);
96f03c8cb29f2e Jens Axboe 2025-11-24 385
96f03c8cb29f2e Jens Axboe 2025-11-24 386 iov_iter_bvec(&iter, rw, bvec, nr_bvec, blk_rq_bytes(rq));
96f03c8cb29f2e Jens Axboe 2025-11-24 387 iter.iov_offset = offset;
fd858d1ca9694c Ming Lei 2025-10-15 388
fd858d1ca9694c Ming Lei 2025-10-15 389 cmd->iocb.ki_pos = pos;
96f03c8cb29f2e Jens Axboe 2025-11-24 390 cmd->iocb.ki_filp = file;
fd858d1ca9694c Ming Lei 2025-10-15 391 cmd->iocb.ki_ioprio = req_get_ioprio(rq);
fd858d1ca9694c Ming Lei 2025-10-15 392 if (cmd->use_aio) {
fd858d1ca9694c Ming Lei 2025-10-15 393 cmd->iocb.ki_complete = lo_rw_aio_complete;
fd858d1ca9694c Ming Lei 2025-10-15 394 cmd->iocb.ki_flags = IOCB_DIRECT;
fd858d1ca9694c Ming Lei 2025-10-15 395 } else {
fd858d1ca9694c Ming Lei 2025-10-15 396 cmd->iocb.ki_complete = NULL;
fd858d1ca9694c Ming Lei 2025-10-15 397 cmd->iocb.ki_flags = 0;
fd858d1ca9694c Ming Lei 2025-10-15 398 }
bc07c10a3603a5 Ming Lei 2015-08-17 399
1a83d226268cfb Tetsuo Handa 2026-05-08 @400 if (!file)
1a83d226268cfb Tetsuo Handa 2026-05-08 401 pr_err("%s(loop%d) starting %s with NULL file (already cleared?)\n",
1a83d226268cfb Tetsuo Handa 2026-05-08 402 __func__, lo->lo_number, rw == ITER_SOURCE ? "write" : "read");
presumably this is debug code which isn't going to be merged but
1a83d226268cfb Tetsuo Handa 2026-05-08 403 else if (!file_count(file))
1a83d226268cfb Tetsuo Handa 2026-05-08 404 pr_err("%s(loop%d) starting %s with raw_refcnt=0x%lx (already released?)\n",
1a83d226268cfb Tetsuo Handa 2026-05-08 405 __func__, lo->lo_number, rw == ITER_SOURCE ? "write" : "read",
1a83d226268cfb Tetsuo Handa 2026-05-08 406 __file_ref_read_raw(&file->f_ref));
1a83d226268cfb Tetsuo Handa 2026-05-08 407 else if (IS_ENABLED(CONFIG_DEBUG_AID_FOR_SYZBOT))
1a83d226268cfb Tetsuo Handa 2026-05-08 408 pr_info("%s(loop%d) starting %s with raw_refcnt=0x%lx, refcnt=%lu\n",
1a83d226268cfb Tetsuo Handa 2026-05-08 409 __func__, lo->lo_number, rw == ITER_SOURCE ? "write" : "read",
1a83d226268cfb Tetsuo Handa 2026-05-08 410 __file_ref_read_raw(&file->f_ref), file_count(file));
39d86db34e41b9 Ming Lei 2025-05-27 411 if (rw == ITER_SOURCE) {
c4706c5058a7bd Ming Lei 2025-07-16 412 kiocb_start_write(&cmd->iocb);
7c98f7cb8fda96 Miklos Szeredi 2023-08-28 @413 ret = file->f_op->write_iter(&cmd->iocb, &iter);
39d86db34e41b9 Ming Lei 2025-05-27 414 } else
7c98f7cb8fda96 Miklos Szeredi 2023-08-28 415 ret = file->f_op->read_iter(&cmd->iocb, &iter);
it file is NULL then it's going to crash here.
bc07c10a3603a5 Ming Lei 2015-08-17 416
92d773324b7edb Shaohua Li 2017-09-01 417 lo_rw_aio_do_completion(cmd);
92d773324b7edb Shaohua Li 2017-09-01 418
bc07c10a3603a5 Ming Lei 2015-08-17 419 if (ret != -EIOCBQUEUED)
6b19b766e8f077 Jens Axboe 2021-10-21 420 lo_rw_aio_complete(&cmd->iocb, ret);
f2fed441c69b92 Christoph Hellwig 2025-04-09 421 return -EIOCBQUEUED;
bc07c10a3603a5 Ming Lei 2015-08-17 422 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-05-09 12:57 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-09 12:56 kernel test robot [this message]
2026-05-09 13:19 ` [linux-next:master 4172/4394] drivers/block/loop.c:413 lo_rw_aio() error: we previously assumed 'file' could be null (see line 400) Dan Carpenter
2026-05-09 13:32 ` Tetsuo Handa
2026-05-09 13:37 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202605092030.FAH71Jou-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.