* [tglx-devel:queue/core 1/1] lib/debugobjects.c:730 debug_object_activate() error: 'obj' dereferencing possible ERR_PTR()
@ 2023-11-20 8:55 Dan Carpenter
2023-11-21 15:17 ` Thomas Gleixner
0 siblings, 1 reply; 4+ messages in thread
From: Dan Carpenter @ 2023-11-20 8:55 UTC (permalink / raw)
To: oe-kbuild, Andrzej Hajda; +Cc: lkp, oe-kbuild-all, Thomas Gleixner
tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/devel.git queue/core
head: 265c43c4e983edc38cb9b0b75fc82eda0808512d
commit: 265c43c4e983edc38cb9b0b75fc82eda0808512d [1/1] debugobjects: Stop accessing objects after releasing hash bucket lock
config: i386-randconfig-141-20231107 (https://download.01.org/0day-ci/archive/20231109/202311092147.YQefKK78-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce: (https://download.01.org/0day-ci/archive/20231109/202311092147.YQefKK78-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202311092147.YQefKK78-lkp@intel.com/
smatch warnings:
lib/debugobjects.c:730 debug_object_activate() error: 'obj' dereferencing possible ERR_PTR()
vim +/obj +730 lib/debugobjects.c
aedcade6f4fa9a Stephen Boyd 2020-08-14 694 int debug_object_activate(void *addr, const struct debug_obj_descr *descr)
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 695 {
63a759694eed61 Thomas Gleixner 2023-04-12 696 struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 697 struct debug_bucket *db;
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 698 struct debug_obj *obj;
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 699 unsigned long flags;
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 700
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 701 if (!debug_objects_enabled)
b778ae25366e6f Paul E. McKenney 2013-04-23 702 return 0;
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 703
0af462f19e635a Thomas Gleixner 2023-05-01 704 debug_objects_fill_pool();
0af462f19e635a Thomas Gleixner 2023-05-01 705
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 706 db = get_bucket((unsigned long) addr);
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 707
aef9cb05247df3 Thomas Gleixner 2009-11-17 708 raw_spin_lock_irqsave(&db->lock, flags);
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 709
63a759694eed61 Thomas Gleixner 2023-04-12 710 obj = lookup_object_or_alloc(addr, db, descr, false, true);
265c43c4e983ed Andrzej Hajda 2023-10-25 711 if (unlikely(!obj)) {
265c43c4e983ed Andrzej Hajda 2023-10-25 712 raw_spin_unlock_irqrestore(&db->lock, flags);
265c43c4e983ed Andrzej Hajda 2023-10-25 713 debug_objects_oom();
265c43c4e983ed Andrzej Hajda 2023-10-25 714 return 0;
265c43c4e983ed Andrzej Hajda 2023-10-25 715 } else if (likely(!IS_ERR(obj))) {
^^^^^^^^^^^^
obj is an error pointer
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 716 switch (obj->state) {
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 717 case ODEBUG_STATE_ACTIVE:
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 718 case ODEBUG_STATE_DESTROYED:
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 719 break;
265c43c4e983ed Andrzej Hajda 2023-10-25 720 case ODEBUG_STATE_INIT:
265c43c4e983ed Andrzej Hajda 2023-10-25 721 case ODEBUG_STATE_INACTIVE:
265c43c4e983ed Andrzej Hajda 2023-10-25 722 obj->state = ODEBUG_STATE_ACTIVE;
265c43c4e983ed Andrzej Hajda 2023-10-25 723 fallthrough;
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 724 default:
aef9cb05247df3 Thomas Gleixner 2009-11-17 725 raw_spin_unlock_irqrestore(&db->lock, flags);
265c43c4e983ed Andrzej Hajda 2023-10-25 726 return 0;
265c43c4e983ed Andrzej Hajda 2023-10-25 727 }
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 728 }
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 729
265c43c4e983ed Andrzej Hajda 2023-10-25 @730 o = *obj;
^^^^^
Unchecked dereference
aef9cb05247df3 Thomas Gleixner 2009-11-17 731 raw_spin_unlock_irqrestore(&db->lock, flags);
265c43c4e983ed Andrzej Hajda 2023-10-25 732 debug_print_object(&o, "activate");
d5f34153e52690 Waiman Long 2019-05-20 733
265c43c4e983ed Andrzej Hajda 2023-10-25 734 switch (o.state) {
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [tglx-devel:queue/core 1/1] lib/debugobjects.c:730 debug_object_activate() error: 'obj' dereferencing possible ERR_PTR()
2023-11-20 8:55 [tglx-devel:queue/core 1/1] lib/debugobjects.c:730 debug_object_activate() error: 'obj' dereferencing possible ERR_PTR() Dan Carpenter
@ 2023-11-21 15:17 ` Thomas Gleixner
2023-11-22 9:21 ` Thomas Gleixner
0 siblings, 1 reply; 4+ messages in thread
From: Thomas Gleixner @ 2023-11-21 15:17 UTC (permalink / raw)
To: Dan Carpenter, oe-kbuild, Andrzej Hajda; +Cc: lkp, oe-kbuild-all
On Mon, Nov 20 2023 at 03:55, Dan Carpenter wrote:
> smatch warnings:
> lib/debugobjects.c:730 debug_object_activate() error: 'obj' dereferencing possible ERR_PTR()
>
> vim +/obj +730 lib/debugobjects.c
>
> aedcade6f4fa9a Stephen Boyd 2020-08-14 694 int debug_object_activate(void *addr, const struct debug_obj_descr *descr)
> 3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 695 {
> 63a759694eed61 Thomas Gleixner 2023-04-12 696 struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
> 3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 697 struct debug_bucket *db;
> 3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 698 struct debug_obj *obj;
> 3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 699 unsigned long flags;
> 3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 700
> 3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 701 if (!debug_objects_enabled)
> b778ae25366e6f Paul E. McKenney 2013-04-23 702 return 0;
> 3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 703
> 0af462f19e635a Thomas Gleixner 2023-05-01 704 debug_objects_fill_pool();
> 0af462f19e635a Thomas Gleixner 2023-05-01 705
> 3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 706 db = get_bucket((unsigned long) addr);
> 3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 707
> aef9cb05247df3 Thomas Gleixner 2009-11-17 708 raw_spin_lock_irqsave(&db->lock, flags);
> 3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 709
> 63a759694eed61 Thomas Gleixner 2023-04-12 710 obj = lookup_object_or_alloc(addr, db, descr, false, true);
> 265c43c4e983ed Andrzej Hajda 2023-10-25 711 if (unlikely(!obj)) {
> 265c43c4e983ed Andrzej Hajda 2023-10-25 712 raw_spin_unlock_irqrestore(&db->lock, flags);
> 265c43c4e983ed Andrzej Hajda 2023-10-25 713 debug_objects_oom();
> 265c43c4e983ed Andrzej Hajda 2023-10-25 714 return 0;
> 265c43c4e983ed Andrzej Hajda 2023-10-25 715 } else if (likely(!IS_ERR(obj))) {
> ^^^^^^^^^^^^
> obj is an error pointer
Ah. Right that's silly. lookup_object_or_alloc() either returns a valid
pointer or NULL. Let me amend that before I move it over to tip.
Thanks,
tglx
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [tglx-devel:queue/core 1/1] lib/debugobjects.c:730 debug_object_activate() error: 'obj' dereferencing possible ERR_PTR()
2023-11-21 15:17 ` Thomas Gleixner
@ 2023-11-22 9:21 ` Thomas Gleixner
0 siblings, 0 replies; 4+ messages in thread
From: Thomas Gleixner @ 2023-11-22 9:21 UTC (permalink / raw)
To: Dan Carpenter, oe-kbuild, Andrzej Hajda; +Cc: lkp, oe-kbuild-all
On Tue, Nov 21 2023 at 16:17, Thomas Gleixner wrote:
> On Mon, Nov 20 2023 at 03:55, Dan Carpenter wrote:
>> 265c43c4e983ed Andrzej Hajda 2023-10-25 715 } else if (likely(!IS_ERR(obj))) {
>> ^^^^^^^^^^^^
>> obj is an error pointer
>
> Ah. Right that's silly. lookup_object_or_alloc() either returns a valid
> pointer or NULL. Let me amend that before I move it over to tip.
Bah it does return an error pointer. Let me stare more.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [tglx-devel:queue/core 1/1] lib/debugobjects.c:730 debug_object_activate() error: 'obj' dereferencing possible ERR_PTR()
@ 2023-11-09 13:25 kernel test robot
0 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2023-11-09 13:25 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Dan Carpenter
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Andrzej Hajda <andrzej.hajda@intel.com>
CC: Thomas Gleixner <tglx@linutronix.de>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/devel.git queue/core
head: 265c43c4e983edc38cb9b0b75fc82eda0808512d
commit: 265c43c4e983edc38cb9b0b75fc82eda0808512d [1/1] debugobjects: Stop accessing objects after releasing hash bucket lock
:::::: branch date: 3 days ago
:::::: commit date: 3 days ago
config: i386-randconfig-141-20231107 (https://download.01.org/0day-ci/archive/20231109/202311092147.YQefKK78-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce: (https://download.01.org/0day-ci/archive/20231109/202311092147.YQefKK78-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202311092147.YQefKK78-lkp@intel.com/
smatch warnings:
lib/debugobjects.c:730 debug_object_activate() error: 'obj' dereferencing possible ERR_PTR()
vim +/obj +730 lib/debugobjects.c
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 687
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 688 /**
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 689 * debug_object_activate - debug checks when an object is activated
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 690 * @addr: address of the object
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 691 * @descr: pointer to an object specific debug description structure
b778ae25366e6f Paul E. McKenney 2013-04-23 692 * Returns 0 for success, -EINVAL for check failed.
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 693 */
aedcade6f4fa9a Stephen Boyd 2020-08-14 694 int debug_object_activate(void *addr, const struct debug_obj_descr *descr)
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 695 {
63a759694eed61 Thomas Gleixner 2023-04-12 696 struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 697 struct debug_bucket *db;
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 698 struct debug_obj *obj;
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 699 unsigned long flags;
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 700
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 701 if (!debug_objects_enabled)
b778ae25366e6f Paul E. McKenney 2013-04-23 702 return 0;
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 703
0af462f19e635a Thomas Gleixner 2023-05-01 704 debug_objects_fill_pool();
0af462f19e635a Thomas Gleixner 2023-05-01 705
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 706 db = get_bucket((unsigned long) addr);
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 707
aef9cb05247df3 Thomas Gleixner 2009-11-17 708 raw_spin_lock_irqsave(&db->lock, flags);
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 709
63a759694eed61 Thomas Gleixner 2023-04-12 710 obj = lookup_object_or_alloc(addr, db, descr, false, true);
265c43c4e983ed Andrzej Hajda 2023-10-25 711 if (unlikely(!obj)) {
265c43c4e983ed Andrzej Hajda 2023-10-25 712 raw_spin_unlock_irqrestore(&db->lock, flags);
265c43c4e983ed Andrzej Hajda 2023-10-25 713 debug_objects_oom();
265c43c4e983ed Andrzej Hajda 2023-10-25 714 return 0;
265c43c4e983ed Andrzej Hajda 2023-10-25 715 } else if (likely(!IS_ERR(obj))) {
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 716 switch (obj->state) {
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 717 case ODEBUG_STATE_ACTIVE:
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 718 case ODEBUG_STATE_DESTROYED:
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 719 break;
265c43c4e983ed Andrzej Hajda 2023-10-25 720 case ODEBUG_STATE_INIT:
265c43c4e983ed Andrzej Hajda 2023-10-25 721 case ODEBUG_STATE_INACTIVE:
265c43c4e983ed Andrzej Hajda 2023-10-25 722 obj->state = ODEBUG_STATE_ACTIVE;
265c43c4e983ed Andrzej Hajda 2023-10-25 723 fallthrough;
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 724 default:
aef9cb05247df3 Thomas Gleixner 2009-11-17 725 raw_spin_unlock_irqrestore(&db->lock, flags);
265c43c4e983ed Andrzej Hajda 2023-10-25 726 return 0;
265c43c4e983ed Andrzej Hajda 2023-10-25 727 }
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 728 }
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 729
265c43c4e983ed Andrzej Hajda 2023-10-25 @730 o = *obj;
aef9cb05247df3 Thomas Gleixner 2009-11-17 731 raw_spin_unlock_irqrestore(&db->lock, flags);
265c43c4e983ed Andrzej Hajda 2023-10-25 732 debug_print_object(&o, "activate");
d5f34153e52690 Waiman Long 2019-05-20 733
265c43c4e983ed Andrzej Hajda 2023-10-25 734 switch (o.state) {
265c43c4e983ed Andrzej Hajda 2023-10-25 735 case ODEBUG_STATE_ACTIVE:
265c43c4e983ed Andrzej Hajda 2023-10-25 736 case ODEBUG_STATE_NOTAVAILABLE:
265c43c4e983ed Andrzej Hajda 2023-10-25 737 if (debug_object_fixup(descr->fixup_activate, addr, o.state))
63a759694eed61 Thomas Gleixner 2023-04-12 738 return 0;
265c43c4e983ed Andrzej Hajda 2023-10-25 739 fallthrough;
265c43c4e983ed Andrzej Hajda 2023-10-25 740 default:
265c43c4e983ed Andrzej Hajda 2023-10-25 741 return -EINVAL;
63a759694eed61 Thomas Gleixner 2023-04-12 742 }
b778ae25366e6f Paul E. McKenney 2013-04-23 743 }
f8ff04e2be0815 Chris Wilson 2016-11-30 744 EXPORT_SYMBOL_GPL(debug_object_activate);
3ac7fe5a4aab40 Thomas Gleixner 2008-04-30 745
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-11-22 9:21 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-11-20 8:55 [tglx-devel:queue/core 1/1] lib/debugobjects.c:730 debug_object_activate() error: 'obj' dereferencing possible ERR_PTR() Dan Carpenter
2023-11-21 15:17 ` Thomas Gleixner
2023-11-22 9:21 ` Thomas Gleixner
-- strict thread matches above, loose matches on Subject: below --
2023-11-09 13:25 kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.