diff for duplicates of <202610020116.n8KvKthY-lkp@intel.com> diff --git a/a/1.txt b/N1/1.txt index 00424e1..1e87c74 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -1,15 +1,6 @@ -Unfiltered warning: this smatch report is sent as-is and has not been -reviewed for false positives, so please treat it with due skepticism. - -BCC: lkp@intel.com -CC: oe-kbuild-all@lists.linux.dev -TO: cros-kernel-buildreports@googlegroups.com - tree: https://chromium.googlesource.com/chromiumos/third_party/kernel chromeos-6.1 head: e2d429338ffa976942aba4887d0b8a7e07dc0267 commit: e341b7975bd72d3ebda92b8d747d0aad15ce8717 [18/18] cifs: handle when server stops supporting multichannel -:::::: branch date: 11 hours ago -:::::: commit date: 10 weeks ago config: x86_64-randconfig-2200-20261001 (https://download.01.org/0day-ci/archive/20261002/202610020116.n8KvKthY-lkp@intel.com/config) compiler: clang version 22.1.8 (https://github.com/llvm/llvm-project ca7933e47d3a3451d81e72ac174dcb5aa28b59d1) smatch: v0.5.0-9187-g5189e3fb @@ -25,12 +16,6 @@ fs/smb/client/sess.c:310 cifs_disable_secondary_channels() error: dereferencing vim +/iface +310 fs/smb/client/sess.c -d70e9fa5588476 fs/cifs/sess.c Aurelien Aptel 2019-09-20 279 -e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 280 /* -e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 281 * called when multichannel is disabled by the server. -e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 282 * this always gets called from smb2_reconnect -e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 283 * and cannot get called in parallel threads. -e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 284 */ e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 285 void e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 286 cifs_disable_secondary_channels(struct cifs_ses *ses) e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 287 { @@ -55,10 +40,16 @@ e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 305 e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 306 if (iface) { e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 307 spin_lock(&ses->iface_lock); e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 @308 kref_put(&iface->refcount, release_iface); + ^^^^^^^^^^^^^ +iface released + e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 309 ses->chans[i].iface = NULL; e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 @310 iface->num_channels--; e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 311 if (iface->weight_fulfilled) e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 312 iface->weight_fulfilled--; + +and then dereferenced. Use after free. + e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 313 spin_unlock(&ses->iface_lock); e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 314 } e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 315 @@ -79,7 +70,6 @@ e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 329 e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 330 done: e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 331 spin_unlock(&ses->chan_lock); e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 332 } -e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 333 -- 0-DAY CI Kernel Test Service diff --git a/a/content_digest b/N1/content_digest index 5ca7ed3..30fd043 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -1,23 +1,15 @@ - "From\0kernel test robot <lkp@intel.com>\0" + "From\0Dan Carpenter <error27@gmail.com>\0" "Subject\0[chrome-os:chromeos-6.1 18/18] fs/smb/client/sess.c:310 cifs_disable_secondary_channels() error: dereferencing freed memory 'iface' (line 308)\0" - "Date\0Fri, 02 Oct 2026 01:52:51 +0200\0" - "To\0oe-kbuild@lists.linux.dev\0" + "Date\0Fri, 2 Oct 2026 08:06:23 +0300\0" + "To\0oe-kbuild@lists.linux.dev" + " cros-kernel-buildreports@googlegroups.com\0" "Cc\0lkp@intel.com" - " Dan Carpenter <error27@gmail.com>\0" + " oe-kbuild-all@lists.linux.dev\0" "\00:1\0" "b\0" - "Unfiltered warning: this smatch report is sent as-is and has not been\n" - "reviewed for false positives, so please treat it with due skepticism.\n" - "\n" - "BCC: lkp@intel.com\n" - "CC: oe-kbuild-all@lists.linux.dev\n" - "TO: cros-kernel-buildreports@googlegroups.com\n" - "\n" "tree: https://chromium.googlesource.com/chromiumos/third_party/kernel chromeos-6.1\n" "head: e2d429338ffa976942aba4887d0b8a7e07dc0267\n" "commit: e341b7975bd72d3ebda92b8d747d0aad15ce8717 [18/18] cifs: handle when server stops supporting multichannel\n" - ":::::: branch date: 11 hours ago\n" - ":::::: commit date: 10 weeks ago\n" "config: x86_64-randconfig-2200-20261001 (https://download.01.org/0day-ci/archive/20261002/202610020116.n8KvKthY-lkp@intel.com/config)\n" "compiler: clang version 22.1.8 (https://github.com/llvm/llvm-project ca7933e47d3a3451d81e72ac174dcb5aa28b59d1)\n" "smatch: v0.5.0-9187-g5189e3fb\n" @@ -33,12 +25,6 @@ "\n" "vim +/iface +310 fs/smb/client/sess.c\n" "\n" - "d70e9fa5588476 fs/cifs/sess.c Aurelien Aptel 2019-09-20 279 \n" - "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 280 /*\n" - "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 281 * called when multichannel is disabled by the server.\n" - "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 282 * this always gets called from smb2_reconnect\n" - "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 283 * and cannot get called in parallel threads.\n" - "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 284 */\n" "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 285 void\n" "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 286 cifs_disable_secondary_channels(struct cifs_ses *ses)\n" "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 287 {\n" @@ -63,10 +49,16 @@ "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 306 \t\tif (iface) {\n" "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 307 \t\t\tspin_lock(&ses->iface_lock);\n" "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 @308 \t\t\tkref_put(&iface->refcount, release_iface);\n" + " ^^^^^^^^^^^^^\n" + "iface released\n" + "\n" "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 309 \t\t\tses->chans[i].iface = NULL;\n" "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 @310 \t\t\tiface->num_channels--;\n" "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 311 \t\t\tif (iface->weight_fulfilled)\n" "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 312 \t\t\t\tiface->weight_fulfilled--;\n" + "\n" + "and then dereferenced. Use after free.\n" + "\n" "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 313 \t\t\tspin_unlock(&ses->iface_lock);\n" "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 314 \t\t}\n" "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 315 \n" @@ -87,10 +79,9 @@ "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 330 done:\n" "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 331 \tspin_unlock(&ses->chan_lock);\n" "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 332 }\n" - "e341b7975bd72d fs/smb/client/sess.c Shyam Prasad N 2026-07-16 333 \n" "\n" "--\n" "0-DAY CI Kernel Test Service\n" https://github.com/intel/lkp-tests/wiki -2b722ad349402954f3b9cd62ecca6ea4e6502da9013767ca437619f331c2e38d +92d5efab8c0ee6efd8e9529b948665a0b387d21f917bc652d270a780e3a0a67f
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.