From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [akpm-mm:mm-nonmm-unstable 139/151] fs/squashfs/namei.c:283 squashfs_lookup() warn: passing zero to 'ERR_PTR'
Date: Fri, 13 Nov 2026 19:15:16 +0100 [thread overview]
Message-ID: <202611131955.0Gd7ipSP-lkp@intel.com> (raw)
Unfiltered warning: this smatch report is sent as-is and has not been
reviewed for false positives, so please treat it with due skepticism.
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: David Hildenbrand <david@kernel.org>
CC: Andrew Morton <akpm@linux-foundation.org>
CC: Linux Memory Management List <linux-mm@kvack.org>
CC: mm-commits@vger.kernel.org
TO: Phillip Lougher <phillip@squashfs.org.uk>
CC: Andrew Morton <akpm@linux-foundation.org>
CC: Linux Memory Management List <linux-mm@kvack.org>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-nonmm-unstable
head: 152f0559e66c079f717de375f133ff127afb1f58
commit: 5213b0a08263b2191b86b046c3a63f11e8abc399 [139/151] Squashfs: fix variables in directory code and add more sanity checks
:::::: branch date: 10 hours ago
:::::: commit date: 10 hours ago
config: um-randconfig-2200-20261113 (https://download.01.org/0day-ci/archive/20261113/202611131955.0Gd7ipSP-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 8621950157210c1fa68f20f0614cb51310ec9dff)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202611131955.0Gd7ipSP-lkp@intel.com/
New smatch warnings:
fs/squashfs/namei.c:283 squashfs_lookup() warn: passing zero to 'ERR_PTR'
Old smatch warnings:
fs/squashfs/namei.c:181 squashfs_lookup() warn: unsigned 'block' is never less than zero.
fs/squashfs/namei.c:181 squashfs_lookup() warn: error code type promoted to positive: 'block'
vim +/ERR_PTR +283 fs/squashfs/namei.c
c88da2c979369e6 Phillip Lougher 2009-01-05 162
c88da2c979369e6 Phillip Lougher 2009-01-05 163
c88da2c979369e6 Phillip Lougher 2009-01-05 164 static struct dentry *squashfs_lookup(struct inode *dir, struct dentry *dentry,
00cd8dd3bf95f2c Al Viro 2012-06-10 165 unsigned int flags)
c88da2c979369e6 Phillip Lougher 2009-01-05 166 {
c88da2c979369e6 Phillip Lougher 2009-01-05 167 const unsigned char *name = dentry->d_name.name;
c88da2c979369e6 Phillip Lougher 2009-01-05 168 int len = dentry->d_name.len;
c88da2c979369e6 Phillip Lougher 2009-01-05 169 struct inode *inode = NULL;
c88da2c979369e6 Phillip Lougher 2009-01-05 170 struct squashfs_sb_info *msblk = dir->i_sb->s_fs_info;
c88da2c979369e6 Phillip Lougher 2009-01-05 171 struct squashfs_dir_header dirh;
4dddf794b08bef0 Phillip Lougher 2026-11-11 172 struct squashfs_dir_entry *dire = NULL;
4dddf794b08bef0 Phillip Lougher 2026-11-11 173 u64 block = squashfs_dir_start(squashfs_i(dir)->start, msblk);
c88da2c979369e6 Phillip Lougher 2009-01-05 174 int offset = squashfs_i(dir)->offset;
5213b0a08263b21 Phillip Lougher 2026-11-11 175 int err;
5213b0a08263b21 Phillip Lougher 2026-11-11 176 loff_t length;
52e9ce1c0f20606 Phillip Lougher 2013-09-03 177 unsigned int dir_count, size;
c88da2c979369e6 Phillip Lougher 2009-01-05 178
4dddf794b08bef0 Phillip Lougher 2026-11-11 179 TRACE("Entered squashfs_lookup [%llx:%x]\n", squashfs_i(dir)->start, offset);
4dddf794b08bef0 Phillip Lougher 2026-11-11 180
4dddf794b08bef0 Phillip Lougher 2026-11-11 181 if (block < 0)
4dddf794b08bef0 Phillip Lougher 2026-11-11 182 goto data_error;
c88da2c979369e6 Phillip Lougher 2009-01-05 183
c88da2c979369e6 Phillip Lougher 2009-01-05 184 dire = kmalloc(sizeof(*dire) + SQUASHFS_NAME_LEN + 1, GFP_KERNEL);
c88da2c979369e6 Phillip Lougher 2009-01-05 185 if (dire == NULL) {
c88da2c979369e6 Phillip Lougher 2009-01-05 186 ERROR("Failed to allocate squashfs_dir_entry\n");
c88da2c979369e6 Phillip Lougher 2009-01-05 187 return ERR_PTR(-ENOMEM);
c88da2c979369e6 Phillip Lougher 2009-01-05 188 }
c88da2c979369e6 Phillip Lougher 2009-01-05 189
c88da2c979369e6 Phillip Lougher 2009-01-05 190 if (len > SQUASHFS_NAME_LEN) {
c88da2c979369e6 Phillip Lougher 2009-01-05 191 err = -ENAMETOOLONG;
c88da2c979369e6 Phillip Lougher 2009-01-05 192 goto failed;
c88da2c979369e6 Phillip Lougher 2009-01-05 193 }
c88da2c979369e6 Phillip Lougher 2009-01-05 194
c88da2c979369e6 Phillip Lougher 2009-01-05 195 length = get_dir_index_using_name(dir->i_sb, &block, &offset,
c88da2c979369e6 Phillip Lougher 2009-01-05 196 squashfs_i(dir)->dir_idx_start,
c88da2c979369e6 Phillip Lougher 2009-01-05 197 squashfs_i(dir)->dir_idx_offset,
5213b0a08263b21 Phillip Lougher 2026-11-11 198 squashfs_i(dir)->dir_idx_cnt,
5213b0a08263b21 Phillip Lougher 2026-11-11 199 i_size_read(dir), name);
c88da2c979369e6 Phillip Lougher 2009-01-05 200
c88da2c979369e6 Phillip Lougher 2009-01-05 201 while (length < i_size_read(dir)) {
c88da2c979369e6 Phillip Lougher 2009-01-05 202 /*
c88da2c979369e6 Phillip Lougher 2009-01-05 203 * Read directory header.
c88da2c979369e6 Phillip Lougher 2009-01-05 204 */
5213b0a08263b21 Phillip Lougher 2026-11-11 205 if (!squashfs_dir_space(dir, length, sizeof(dirh)))
5213b0a08263b21 Phillip Lougher 2026-11-11 206 goto read_failure;
5213b0a08263b21 Phillip Lougher 2026-11-11 207
c88da2c979369e6 Phillip Lougher 2009-01-05 208 err = squashfs_read_metadata(dir->i_sb, &dirh, &block,
c88da2c979369e6 Phillip Lougher 2009-01-05 209 &offset, sizeof(dirh));
c88da2c979369e6 Phillip Lougher 2009-01-05 210 if (err < 0)
c88da2c979369e6 Phillip Lougher 2009-01-05 211 goto read_failure;
c88da2c979369e6 Phillip Lougher 2009-01-05 212
c88da2c979369e6 Phillip Lougher 2009-01-05 213 length += sizeof(dirh);
c88da2c979369e6 Phillip Lougher 2009-01-05 214
c88da2c979369e6 Phillip Lougher 2009-01-05 215 dir_count = le32_to_cpu(dirh.count) + 1;
44cff8a9ee8a974 Phillip Lougher 2011-03-15 216
4826d83d9c4f6bb Ajeet Yadav 2012-02-02 217 if (dir_count > SQUASHFS_DIR_COUNT)
44cff8a9ee8a974 Phillip Lougher 2011-03-15 218 goto data_error;
44cff8a9ee8a974 Phillip Lougher 2011-03-15 219
c88da2c979369e6 Phillip Lougher 2009-01-05 220 while (dir_count--) {
c88da2c979369e6 Phillip Lougher 2009-01-05 221 /*
c88da2c979369e6 Phillip Lougher 2009-01-05 222 * Read directory entry.
c88da2c979369e6 Phillip Lougher 2009-01-05 223 */
5213b0a08263b21 Phillip Lougher 2026-11-11 224 if (!squashfs_dir_space(dir, length, sizeof(*dire)))
5213b0a08263b21 Phillip Lougher 2026-11-11 225 goto read_failure;
5213b0a08263b21 Phillip Lougher 2026-11-11 226
c88da2c979369e6 Phillip Lougher 2009-01-05 227 err = squashfs_read_metadata(dir->i_sb, dire, &block,
c88da2c979369e6 Phillip Lougher 2009-01-05 228 &offset, sizeof(*dire));
c88da2c979369e6 Phillip Lougher 2009-01-05 229 if (err < 0)
c88da2c979369e6 Phillip Lougher 2009-01-05 230 goto read_failure;
c88da2c979369e6 Phillip Lougher 2009-01-05 231
5213b0a08263b21 Phillip Lougher 2026-11-11 232 length += sizeof(*dire);
c88da2c979369e6 Phillip Lougher 2009-01-05 233 size = le16_to_cpu(dire->size) + 1;
c88da2c979369e6 Phillip Lougher 2009-01-05 234
44cff8a9ee8a974 Phillip Lougher 2011-03-15 235 /* size should never be larger than SQUASHFS_NAME_LEN */
44cff8a9ee8a974 Phillip Lougher 2011-03-15 236 if (size > SQUASHFS_NAME_LEN)
44cff8a9ee8a974 Phillip Lougher 2011-03-15 237 goto data_error;
44cff8a9ee8a974 Phillip Lougher 2011-03-15 238
5213b0a08263b21 Phillip Lougher 2026-11-11 239 if (!squashfs_dir_space(dir, length, size))
5213b0a08263b21 Phillip Lougher 2026-11-11 240 goto read_failure;
5213b0a08263b21 Phillip Lougher 2026-11-11 241
c88da2c979369e6 Phillip Lougher 2009-01-05 242 err = squashfs_read_metadata(dir->i_sb, dire->name,
c88da2c979369e6 Phillip Lougher 2009-01-05 243 &block, &offset, size);
c88da2c979369e6 Phillip Lougher 2009-01-05 244 if (err < 0)
c88da2c979369e6 Phillip Lougher 2009-01-05 245 goto read_failure;
c88da2c979369e6 Phillip Lougher 2009-01-05 246
5213b0a08263b21 Phillip Lougher 2026-11-11 247 length += size;
c88da2c979369e6 Phillip Lougher 2009-01-05 248
c88da2c979369e6 Phillip Lougher 2009-01-05 249 if (name[0] < dire->name[0])
c88da2c979369e6 Phillip Lougher 2009-01-05 250 goto exit_lookup;
c88da2c979369e6 Phillip Lougher 2009-01-05 251
c88da2c979369e6 Phillip Lougher 2009-01-05 252 if (len == size && !strncmp(name, dire->name, len)) {
c88da2c979369e6 Phillip Lougher 2009-01-05 253 unsigned int blk, off, ino_num;
c88da2c979369e6 Phillip Lougher 2009-01-05 254 long long ino;
c88da2c979369e6 Phillip Lougher 2009-01-05 255 blk = le32_to_cpu(dirh.start_block);
c88da2c979369e6 Phillip Lougher 2009-01-05 256 off = le16_to_cpu(dire->offset);
c88da2c979369e6 Phillip Lougher 2009-01-05 257 ino_num = le32_to_cpu(dirh.inode_number) +
c88da2c979369e6 Phillip Lougher 2009-01-05 258 (short) le16_to_cpu(dire->inode_number);
cec4a69189091ba Phillip Lougher 2026-11-11 259 ino = squashfs_mkinode(blk, off);
c88da2c979369e6 Phillip Lougher 2009-01-05 260
c88da2c979369e6 Phillip Lougher 2009-01-05 261 TRACE("calling squashfs_iget for directory "
c88da2c979369e6 Phillip Lougher 2009-01-05 262 "entry %s, inode %x:%x, %d\n", name,
c88da2c979369e6 Phillip Lougher 2009-01-05 263 blk, off, ino_num);
c88da2c979369e6 Phillip Lougher 2009-01-05 264
c88da2c979369e6 Phillip Lougher 2009-01-05 265 inode = squashfs_iget(dir->i_sb, ino, ino_num);
c88da2c979369e6 Phillip Lougher 2009-01-05 266 goto exit_lookup;
c88da2c979369e6 Phillip Lougher 2009-01-05 267 }
c88da2c979369e6 Phillip Lougher 2009-01-05 268 }
c88da2c979369e6 Phillip Lougher 2009-01-05 269 }
c88da2c979369e6 Phillip Lougher 2009-01-05 270
c88da2c979369e6 Phillip Lougher 2009-01-05 271 exit_lookup:
c88da2c979369e6 Phillip Lougher 2009-01-05 272 kfree(dire);
c88da2c979369e6 Phillip Lougher 2009-01-05 273 return d_splice_alias(inode, dentry);
c88da2c979369e6 Phillip Lougher 2009-01-05 274
44cff8a9ee8a974 Phillip Lougher 2011-03-15 275 data_error:
44cff8a9ee8a974 Phillip Lougher 2011-03-15 276 err = -EIO;
44cff8a9ee8a974 Phillip Lougher 2011-03-15 277
c88da2c979369e6 Phillip Lougher 2009-01-05 278 read_failure:
c88da2c979369e6 Phillip Lougher 2009-01-05 279 ERROR("Unable to read directory block [%llx:%x]\n",
4dddf794b08bef0 Phillip Lougher 2026-11-11 280 squashfs_i(dir)->start, squashfs_i(dir)->offset);
c88da2c979369e6 Phillip Lougher 2009-01-05 281 failed:
c88da2c979369e6 Phillip Lougher 2009-01-05 282 kfree(dire);
c88da2c979369e6 Phillip Lougher 2009-01-05 @283 return ERR_PTR(err);
c88da2c979369e6 Phillip Lougher 2009-01-05 284 }
c88da2c979369e6 Phillip Lougher 2009-01-05 285
:::::: The code at line 283 was first introduced by commit
:::::: c88da2c979369e6bf8d2c0c80fad2f90c35e64ce Squashfs: directory lookup operations
:::::: TO: Phillip Lougher <phillip@lougher.demon.co.uk>
:::::: CC: Phillip Lougher <phillip@lougher.demon.co.uk>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-11-13 18:15 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202611131955.0Gd7ipSP-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.