From: kernel test robot <lkp@intel.com>
To: Fengnan Chang <fengnanchang@gmail.com>,
axboe@kernel.dk, linux-block@vger.kernel.org,
ming.lei@redhat.com, hare@suse.de, hch@lst.de,
yukuai3@huawei.com
Cc: oe-kbuild-all@lists.linux.dev,
Fengnan Chang <changfengnan@bytedance.com>
Subject: Re: [PATCH v2 2/2] blk-mq: fix potential uaf for 'queue_hw_ctx'
Date: Fri, 28 Nov 2025 04:30:45 +0800 [thread overview]
Message-ID: <202511280340.4LxTSm2A-lkp@intel.com> (raw)
In-Reply-To: <20251127013908.66118-3-fengnanchang@gmail.com>
Hi Fengnan,
kernel test robot noticed the following build warnings:
[auto build test WARNING on 4941a17751c99e17422be743c02c923ad706f888]
url: https://github.com/intel-lab-lkp/linux/commits/Fengnan-Chang/blk-mq-use-array-manage-hctx-map-instead-of-xarray/20251127-094243
base: 4941a17751c99e17422be743c02c923ad706f888
patch link: https://lore.kernel.org/r/20251127013908.66118-3-fengnanchang%40gmail.com
patch subject: [PATCH v2 2/2] blk-mq: fix potential uaf for 'queue_hw_ctx'
config: arm64-randconfig-r131-20251128 (https://download.01.org/0day-ci/archive/20251128/202511280340.4LxTSm2A-lkp@intel.com/config)
compiler: aarch64-linux-gcc (GCC) 11.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251128/202511280340.4LxTSm2A-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202511280340.4LxTSm2A-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
block/blk-mq-sysfs.c: note: in included file:
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
--
block/blk-mq-sched.c: note: in included file:
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
--
block/blk-mq-tag.c: note: in included file:
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
--
block/blk-mq-debugfs.c: note: in included file:
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
--
block/kyber-iosched.c: note: in included file (through block/elevator.h):
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
--
block/blk-mq.c:726:19: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct blk_mq_hw_ctx *hctx @@ got struct blk_mq_hw_ctx [noderef] __rcu * @@
block/blk-mq.c:726:19: sparse: expected struct blk_mq_hw_ctx *hctx
block/blk-mq.c:726:19: sparse: got struct blk_mq_hw_ctx [noderef] __rcu *
block/blk-mq.c:4514:41: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct blk_mq_hw_ctx **hctxs @@ got struct blk_mq_hw_ctx [noderef] __rcu **queue_hw_ctx @@
block/blk-mq.c:4514:41: sparse: expected struct blk_mq_hw_ctx **hctxs
block/blk-mq.c:4514:41: sparse: got struct blk_mq_hw_ctx [noderef] __rcu **queue_hw_ctx
block/blk-mq.c:4527:17: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.c:4527:17: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.c:4527:17: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.c:5192:48: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected struct blk_mq_hw_ctx *hctx @@ got struct blk_mq_hw_ctx [noderef] __rcu * @@
block/blk-mq.c:5192:48: sparse: expected struct blk_mq_hw_ctx *hctx
block/blk-mq.c:5192:48: sparse: got struct blk_mq_hw_ctx [noderef] __rcu *
block/blk-mq.c: note: in included file:
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
>> block/blk-mq.h:95:16: sparse: sparse: incompatible types in comparison expression (different address spaces):
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu *
block/blk-mq.h:95:16: sparse: struct blk_mq_hw_ctx [noderef] __rcu **
vim +95 block/blk-mq.h
89
90 static inline struct blk_mq_hw_ctx *queue_hctx(struct request_queue *q, int id)
91 {
92 struct blk_mq_hw_ctx *hctx;
93
94 rcu_read_lock();
> 95 hctx = rcu_dereference(q->queue_hw_ctx)[id];
96 rcu_read_unlock();
97
98 return hctx;
99 }
100
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next prev parent reply other threads:[~2025-11-27 20:31 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-27 1:39 [PATCH v2 0/2] blk-mq: use array manage hctx map instead of xarray Fengnan Chang
2025-11-27 1:39 ` [PATCH v2 1/2] " Fengnan Chang
2025-11-27 1:39 ` [PATCH v2 2/2] blk-mq: fix potential uaf for 'queue_hw_ctx' Fengnan Chang
2025-11-27 3:33 ` Ming Lei
2025-11-27 3:38 ` Ming Lei
2025-11-27 18:46 ` kernel test robot
2025-11-27 20:30 ` kernel test robot [this message]
2025-11-27 20:41 ` kernel test robot
2025-11-27 23:32 ` kernel test robot
2025-11-27 2:47 ` [PATCH v2 0/2] blk-mq: use array manage hctx map instead of xarray Jens Axboe
2025-11-27 2:55 ` fengnan chang
2025-11-27 2:49 ` Jens Axboe
2025-11-27 3:00 ` fengnan chang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202511280340.4LxTSm2A-lkp@intel.com \
--to=lkp@intel.com \
--cc=axboe@kernel.dk \
--cc=changfengnan@bytedance.com \
--cc=fengnanchang@gmail.com \
--cc=hare@suse.de \
--cc=hch@lst.de \
--cc=linux-block@vger.kernel.org \
--cc=ming.lei@redhat.com \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=yukuai3@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).