From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [tytso-ext4:pu 20/50] fs/ext4/resize-test.c:740 resize_test_init() error: dereferencing freed memory 'sbh' (line 738)
Date: Fri, 13 Nov 2026 04:38:02 +0100 [thread overview]
Message-ID: <202611130427.OFf1j9Zw-lkp@intel.com> (raw)
Unfiltered warning: this smatch report is sent as-is and has not been
reviewed for false positives, so please treat it with due skepticism.
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-ext4@vger.kernel.org
TO: "Theodore Ts'o" <tytso@mit.edu>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git pu
head: 246d715a48c25a74ac372dda5e10d8f69f89b50a
commit: cafbd5ed7e5d5024b861114d03d2980d6c6fffe2 [20/50] ext4: add KUnit tests for fs/ext4/resize.c
:::::: branch date: 35 hours ago
:::::: commit date: 35 hours ago
config: powerpc-randconfig-2200-20261112 (https://download.01.org/0day-ci/archive/20261113/202611130427.OFf1j9Zw-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 8621950157210c1fa68f20f0614cb51310ec9dff)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202611130427.OFf1j9Zw-lkp@intel.com/
smatch warnings:
fs/ext4/resize-test.c:740 resize_test_init() error: dereferencing freed memory 'sbh' (line 738)
vim +/sbh +740 fs/ext4/resize-test.c
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 687
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 688 strscpy(sb->s_id, "ext4_resize_kunit", sizeof(sb->s_id));
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 689 inode_init_once(&ctx->bd_inode);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 690 ctx->bd_inode.i_sb = sb;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 691 ctx->bd_inode.i_blkbits = RESIZE_TEST_BLK_BITS;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 692 ctx->bd_inode.i_mapping = &ctx->bd_inode.i_data;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 693 ctx->bd_inode.i_data.host = &ctx->bd_inode;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 694 ctx->bdev_disk.part0 = &ctx->bdev;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 695 ctx->bdev_disk.queue = &ctx->bdev_queue;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 696 ctx->bdev.bd_disk = &ctx->bdev_disk;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 697 ctx->bdev.bd_queue = &ctx->bdev_queue;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 698 ctx->bdev.bd_mapping = &ctx->bd_inode.i_data;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 699 bdev_clear_flag(&ctx->bdev, BD_READ_ONLY);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 700 sb->s_bdev = &ctx->bdev;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 701
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 702 sbi->s_sb = sb;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 703 sbi->s_blockgroup_lock = &ctx->bgl;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 704 bgl_lock_init(&ctx->bgl);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 705 INIT_WORK(&sbi->s_sb_upd_work, resize_test_sb_upd_work);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 706 timer_setup(&sbi->s_err_report, resize_test_err_timer, 0);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 707 spin_lock_init(&sbi->s_error_lock);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 708 spin_lock_init(&sbi->s_md_lock);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 709 spin_lock_init(&sbi->s_bdev_wb_lock);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 710 spin_lock_init(&sbi->s_es_lock);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 711 INIT_LIST_HEAD(&sbi->s_es_list);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 712 mutex_init(&sbi->s_fc_lock);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 713 INIT_LIST_HEAD(&sbi->s_fc_q[FC_Q_MAIN]);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 714 INIT_LIST_HEAD(&sbi->s_fc_q[FC_Q_STAGING]);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 715 INIT_LIST_HEAD(&sbi->s_fc_dentry_q[FC_Q_MAIN]);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 716 INIT_LIST_HEAD(&sbi->s_fc_dentry_q[FC_Q_STAGING]);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 717 ratelimit_state_init(&sbi->s_err_ratelimit_state, 5 * HZ, 10);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 718 ratelimit_state_init(&sbi->s_warning_ratelimit_state, 5 * HZ, 10);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 719 ratelimit_state_init(&sbi->s_msg_ratelimit_state, 5 * HZ, 10);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 720
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 721 sbi->s_blocks_per_group = RESIZE_TEST_BLOCKS_PER_GRP;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 722 sbi->s_clusters_per_group = RESIZE_TEST_BLOCKS_PER_GRP;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 723 sbi->s_cluster_ratio = 1;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 724 sbi->s_cluster_bits = 0;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 725 sbi->s_inodes_per_group = RESIZE_TEST_INODES_PER_GRP;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 726 sbi->s_inode_size = RESIZE_TEST_INODE_SIZE;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 727 sbi->s_inodes_per_block = RESIZE_TEST_BLK_SIZE / RESIZE_TEST_INODE_SIZE;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 728 sbi->s_itb_per_group = RESIZE_TEST_ITB_PER_GRP;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 729 sbi->s_desc_size = RESIZE_TEST_DESC_SIZE;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 730 sbi->s_desc_per_block = RESIZE_TEST_DESC_PER_BLK;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 731 sbi->s_desc_per_block_bits = RESIZE_TEST_DESC_PER_BLK_BITS;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 732 sbi->s_first_ino = 11;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 733 sbi->s_mount_state = EXT4_VALID_FS;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 734 set_opt(sb, ERRORS_CONT);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 735
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 736 sbh = resize_get_or_create_bh(ctx, RESIZE_TEST_FIRST_DATA_BLK);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 737 KUNIT_ASSERT_NOT_NULL(test, sbh);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 @738 brelse(sbh);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 739 sbi->s_sbh = sbh;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 @740 ctx->es = (struct ext4_super_block *)sbh->b_data;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 741 sbi->s_es = ctx->es;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 742
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 743 resize_init_mock_bh(&ctx->iloc_bh, ctx->bh_folio, ctx->iloc_buf,
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 744 RESIZE_TEST_BLK_SIZE, 99);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 745
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 746 active_resize_test = test;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 747 kunit_activate_static_stub(test, ext4_sb_getblk, resize_sb_getblk_stub);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 748 kunit_activate_static_stub(test, ext4_sb_bread, resize_sb_bread_stub);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 749 kunit_activate_static_stub(test, ext4_resize_issue_zeroout,
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 750 resize_zeroout_stub);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 751 kunit_activate_static_stub(test, __ext4_iget, resize_iget_stub);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 752 kunit_activate_static_stub(test, ext4_get_inode_loc,
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 753 resize_get_inode_loc_stub);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 754 kunit_activate_static_stub(test, ext4_mark_iloc_dirty,
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 755 resize_mark_iloc_dirty_stub);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 756 kunit_activate_static_stub(test, __ext4_mark_inode_dirty,
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 757 resize_mark_inode_dirty_stub);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 758 kunit_activate_static_stub(test, ext4_free_blocks,
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 759 resize_free_blocks_stub);
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 760
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 761 return 0;
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 762 }
cafbd5ed7e5d50 Theodore Ts'o 2026-11-11 763
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-11-13 3:38 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202611130427.OFf1j9Zw-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.