Re: [PATCH v2] scsi: target: tcmu: Fix possible data corruption

[Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>]

hi,

Thanks for this report, I'll add the Reported-by in V3 patch.
But before sending V3, I'd like to wait tcmu maintainer to have a brief review.

Regards,
Xiaoguang Wang

> Hi Xiaoguang,
>
> Thank you for the patch! Perhaps something to improve:
>
> [auto build test WARNING on jejb-scsi/for-next]
> [also build test WARNING on v5.18-rc2 next-20220411]
> [cannot apply to mkp-scsi/for-next]
> [If your patch is applied to the wrong git tree, kindly drop us a note.
> And when submitting patch, we suggest to use '--base' as documented in
> https://git-scm.com/docs/git-format-patch]
>
> url:    https://github.com/intel-lab-lkp/linux/commits/Xiaoguang-Wang/scsi-target-tcmu-Fix-possible-data-corruption/20220411-220214
> base:   https://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git for-next
> config: x86_64-rhel-8.3-kselftests (https://download.01.org/0day-ci/archive/20220412/202204121450.qYzuKGXT-lkp@intel.com/config)
> compiler: gcc-11 (Debian 11.2.0-19) 11.2.0
> reproduce:
>         # apt-get install sparse
>         # sparse version: v0.6.4-dirty
>         # https://github.com/intel-lab-lkp/linux/commit/2bceb529129db286e111bc3bae0b52b62b1fba07
>         git remote add linux-review https://github.com/intel-lab-lkp/linux
>         git fetch --no-tags linux-review Xiaoguang-Wang/scsi-target-tcmu-Fix-possible-data-corruption/20220411-220214
>         git checkout 2bceb529129db286e111bc3bae0b52b62b1fba07
>         # save the config file to linux build tree
>         mkdir build_dir
>         make W=1 C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' O=build_dir ARCH=x86_64 SHELL=/bin/bash drivers/target/
>
> If you fix the issue, kindly add following tag as appropriate
> Reported-by: kernel test robot <lkp@intel.com>
>
>
> sparse warnings: (new ones prefixed by >>)
>>> drivers/target/target_core_user.c:1907:21: sparse: sparse: incorrect type in assignment (different base types) @@     expected int ret @@     got restricted vm_fault_t @@
>    drivers/target/target_core_user.c:1907:21: sparse:     expected int ret
>    drivers/target/target_core_user.c:1907:21: sparse:     got restricted vm_fault_t
>>> drivers/target/target_core_user.c:1911:16: sparse: sparse: incorrect type in return expression (different base types) @@     expected restricted vm_fault_t @@     got int ret @@
>    drivers/target/target_core_user.c:1911:16: sparse:     expected restricted vm_fault_t
>    drivers/target/target_core_user.c:1911:16: sparse:     got int ret
>
> vim +1907 drivers/target/target_core_user.c
>
>   1874	
>   1875	static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf)
>   1876	{
>   1877		struct tcmu_dev *udev = vmf->vma->vm_private_data;
>   1878		struct uio_info *info = &udev->uio_info;
>   1879		struct page *page;
>   1880		unsigned long offset;
>   1881		void *addr;
>   1882		int ret = 0;
>   1883	
>   1884		int mi = tcmu_find_mem_index(vmf->vma);
>   1885		if (mi < 0)
>   1886			return VM_FAULT_SIGBUS;
>   1887	
>   1888		/*
>   1889		 * We need to subtract mi because userspace uses offset = N*PAGE_SIZE
>   1890		 * to use mem[N].
>   1891		 */
>   1892		offset = (vmf->pgoff - mi) << PAGE_SHIFT;
>   1893	
>   1894		if (offset < udev->data_off) {
>   1895			/* For the vmalloc()ed cmd area pages */
>   1896			addr = (void *)(unsigned long)info->mem[mi].addr + offset;
>   1897			page = vmalloc_to_page(addr);
>   1898			get_page(page);
>   1899		} else {
>   1900			uint32_t dpi;
>   1901	
>   1902			/* For the dynamically growing data area pages */
>   1903			dpi = (offset - udev->data_off) / PAGE_SIZE;
>   1904			page = tcmu_try_get_data_page(udev, dpi);
>   1905			if (!page)
>   1906				return VM_FAULT_SIGBUS;
>> 1907			ret = VM_FAULT_LOCKED;
>   1908		}
>   1909	
>   1910		vmf->page = page;
>> 1911		return ret;
>   1912	}
>   1913	
>