[PATCH] net/sched: unregister root_lock_key in the error path of qdisc_alloc()

[PATCH] net/sched: unregister root_lock_key in the error path of qdisc_alloc()

[Hou Tao]

From: Hou Tao <houtao1@huawei.com>

The following slab-use-after-free problem was reported by syzbot:

==================================================================
BUG: KASAN: slab-use-after-free in lockdep_register_key+0x253/0x3f0 kernel/locking/lockdep.c:1225
Read of size 8 at addr ffff88805fe2c298 by task syz-executor.1/5906

CPU: 1 PID: 5906 Comm: syz-executor.1 Not tainted 6.9.0-rc5-syzkaller-01473-g2506f6229bd0 #0
......
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:488
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 lockdep_register_key+0x253/0x3f0 kernel/locking/lockdep.c:1225
 htab_map_alloc+0x9b/0xe60 kernel/bpf/hashtab.c:506
 map_create+0x90c/0x1200 kernel/bpf/syscall.c:1333
 __sys_bpf+0x6d1/0x810 kernel/bpf/syscall.c:5659
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
......
 </TASK>

Allocated by task 5593:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slub.c:3966 [inline]
 __kmalloc_node_track_caller+0x24e/0x4e0 mm/slub.c:3986
 kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:597
 __alloc_skb+0x1f3/0x440 net/core/skbuff.c:666
 alloc_skb include/linux/skbuff.h:1308 [inline]
 alloc_skb_with_frags+0xc3/0x770 net/core/skbuff.c:6455
 ......

Freed by task 5593:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240
 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2106 [inline]
 slab_free mm/slub.c:4280 [inline]
 kfree+0x153/0x3a0 mm/slub.c:4390
 skb_kfree_head net/core/skbuff.c:1033 [inline]
 skb_free_head net/core/skbuff.c:1045 [inline]
 ......

The buggy address belongs to the object at ffff88805fe2c000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 664 bytes inside of
 freed 2048-byte region [ffff88805fe2c000, ffff88805fe2c800)

At first glance, it seems there is a problem with bpf hash-table,
because the use-after-free problem is reported when invoking
htab_map_alloc(). However, after checking the reported error more
carefully, it appears that qdiscs_alloc() is the culprit. The most
important clue regarding why qdisc_alloc() is involved is the following:
"The buggy address is located 664 bytes inside of freed 2048-byte
region". lockdep_register_key() has several callers, and only the
offset of lock_class_key in Qdisc in 664. The problem occurs as follow:

(1) call qdisc_alloc()
After calling lockdep_register_key(), qdisc_alloc() jumps to errout1
label because netdev_alloc_pcpu_stats() or alloc_percpu() fails (e.g.,
due to mem-cg limitation or SIGKILL). However it doesn't call
lockdep_unregister_key() to unregister root_lock_key, but it frees the
allocated memory.

(2) call htab_map_alloc
During the calling of lockdep_register_key(), it finds the lockdep_key
registered by free-ed Qdisc and triggers the use-after-free.

Fix it by invoking lockdep_unregister_key() in the error path of
qdisc_alloc().

Reported-by: syzbot+061f58eec3bde7ee8ffa@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/bpf/d28e4f02-965d-96de-ee56-f7a001b67fe7@huaweicloud.com/T/#m47c0670021ada17869bf887c73438133d879d326
Fixes: af0cb3fa3f9e ("net/sched: fix false lockdep warning on qdisc root lock")
Signed-off-by: Hou Tao <houtao1@huawei.com>
---
 net/sched/sch_generic.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 31dfd6c7405b0..d3f6006b563cc 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -982,6 +982,7 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
 
 	return sch;
 errout1:
+	lockdep_unregister_key(&sch->root_lock_key);
 	kfree(sch);
 errout:
 	return ERR_PTR(err);
-- 
2.29.2

Re: [PATCH] net/sched: unregister root_lock_key in the error path of qdisc_alloc()

[Hou Tao]

Oops. Forgot to add the target git tree for the patch. It is targeted
for net- tree.

On 5/16/2024 9:30 PM, Hou Tao wrote:
> From: Hou Tao <houtao1@huawei.com>
>
> The following slab-use-after-free problem was reported by syzbot:
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in lockdep_register_key+0x253/0x3f0 kernel/locking/lockdep.c:1225
> Read of size 8 at addr ffff88805fe2c298 by task syz-executor.1/5906
>
> CPU: 1 PID: 5906 Comm: syz-executor.1 Not tainted 6.9.0-rc5-syzkaller-01473-g2506f6229bd0 #0
> ......
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:88 [inline]
>  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
>  print_address_description mm/kasan/report.c:377 [inline]
>  print_report+0x169/0x550 mm/kasan/report.c:488
>  kasan_report+0x143/0x180 mm/kasan/report.c:601
>  lockdep_register_key+0x253/0x3f0 kernel/locking/lockdep.c:1225
>  htab_map_alloc+0x9b/0xe60 kernel/bpf/hashtab.c:506
>  map_create+0x90c/0x1200 kernel/bpf/syscall.c:1333
>  __sys_bpf+0x6d1/0x810 kernel/bpf/syscall.c:5659
>  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> ......
>  </TASK>
>
> Allocated by task 5593:
>  kasan_save_stack mm/kasan/common.c:47 [inline]
>  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
>  poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
>  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
>  kasan_kmalloc include/linux/kasan.h:211 [inline]
>  __do_kmalloc_node mm/slub.c:3966 [inline]
>  __kmalloc_node_track_caller+0x24e/0x4e0 mm/slub.c:3986
>  kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:597
>  __alloc_skb+0x1f3/0x440 net/core/skbuff.c:666
>  alloc_skb include/linux/skbuff.h:1308 [inline]
>  alloc_skb_with_frags+0xc3/0x770 net/core/skbuff.c:6455
>  ......
>
> Freed by task 5593:
>  kasan_save_stack mm/kasan/common.c:47 [inline]
>  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
>  kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
>  poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240
>  __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
>  kasan_slab_free include/linux/kasan.h:184 [inline]
>  slab_free_hook mm/slub.c:2106 [inline]
>  slab_free mm/slub.c:4280 [inline]
>  kfree+0x153/0x3a0 mm/slub.c:4390
>  skb_kfree_head net/core/skbuff.c:1033 [inline]
>  skb_free_head net/core/skbuff.c:1045 [inline]
>  ......
>
> The buggy address belongs to the object at ffff88805fe2c000
>  which belongs to the cache kmalloc-2k of size 2048
> The buggy address is located 664 bytes inside of
>  freed 2048-byte region [ffff88805fe2c000, ffff88805fe2c800)
>
> At first glance, it seems there is a problem with bpf hash-table,
> because the use-after-free problem is reported when invoking
> htab_map_alloc(). However, after checking the reported error more
> carefully, it appears that qdiscs_alloc() is the culprit. The most
> important clue regarding why qdisc_alloc() is involved is the following:
> "The buggy address is located 664 bytes inside of freed 2048-byte
> region". lockdep_register_key() has several callers, and only the
> offset of lock_class_key in Qdisc in 664. The problem occurs as follow:
>
> (1) call qdisc_alloc()
> After calling lockdep_register_key(), qdisc_alloc() jumps to errout1
> label because netdev_alloc_pcpu_stats() or alloc_percpu() fails (e.g.,
> due to mem-cg limitation or SIGKILL). However it doesn't call
> lockdep_unregister_key() to unregister root_lock_key, but it frees the
> allocated memory.
>
> (2) call htab_map_alloc
> During the calling of lockdep_register_key(), it finds the lockdep_key
> registered by free-ed Qdisc and triggers the use-after-free.
>
> Fix it by invoking lockdep_unregister_key() in the error path of
> qdisc_alloc().
>
> Reported-by: syzbot+061f58eec3bde7ee8ffa@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/bpf/d28e4f02-965d-96de-ee56-f7a001b67fe7@huaweicloud.com/T/#m47c0670021ada17869bf887c73438133d879d326
> Fixes: af0cb3fa3f9e ("net/sched: fix false lockdep warning on qdisc root lock")
> Signed-off-by: Hou Tao <houtao1@huawei.com>
> ---
>  net/sched/sch_generic.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
> index 31dfd6c7405b0..d3f6006b563cc 100644
> --- a/net/sched/sch_generic.c
> +++ b/net/sched/sch_generic.c
> @@ -982,6 +982,7 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
>  
>  	return sch;
>  errout1:
> +	lockdep_unregister_key(&sch->root_lock_key);
>  	kfree(sch);
>  errout:
>  	return ERR_PTR(err);

Re: [PATCH] net/sched: unregister root_lock_key in the error path of qdisc_alloc()

[Davide Caratti]

hello Hou Tao,

On Thu, May 16, 2024 at 3:33 PM Hou Tao <houtao@huaweicloud.com> wrote:
>
> Oops. Forgot to add the target git tree for the patch. It is targeted
> for net- tree.
>
> >
> > diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
> > index 31dfd6c7405b0..d3f6006b563cc 100644
> > --- a/net/sched/sch_generic.c
> > +++ b/net/sched/sch_generic.c
> > @@ -982,6 +982,7 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
> >
> >       return sch;
> >  errout1:
> > +     lockdep_unregister_key(&sch->root_lock_key);
> >       kfree(sch);
> >  errout:
> >       return ERR_PTR(err);
>

AFAIS this line is part of the fix that was merged a couple of weeks
ago, (see the 2nd hunk of [1]). That patch also protects the error
path of qdisc_create(), that proved to make kselftest fail with
similar splats. Can you check if this commit resolves that syzbot?

thanks a lot!
-- 
davide

[1] https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=86735b57c905

Re: [PATCH] net/sched: unregister root_lock_key in the error path of qdisc_alloc()

[Hou Tao]

H Davide,

On 5/16/2024 9:45 PM, Davide Caratti wrote:
> hello Hou Tao,
>
> On Thu, May 16, 2024 at 3:33 PM Hou Tao <houtao@huaweicloud.com> wrote:
>> Oops. Forgot to add the target git tree for the patch. It is targeted
>> for net- tree.
>>
>>> diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
>>> index 31dfd6c7405b0..d3f6006b563cc 100644
>>> --- a/net/sched/sch_generic.c
>>> +++ b/net/sched/sch_generic.c
>>> @@ -982,6 +982,7 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
>>>
>>>       return sch;
>>>  errout1:
>>> +     lockdep_unregister_key(&sch->root_lock_key);
>>>       kfree(sch);
>>>  errout:
>>>       return ERR_PTR(err);
> AFAIS this line is part of the fix that was merged a couple of weeks
> ago, (see the 2nd hunk of [1]). That patch also protects the error
> path of qdisc_create(), that proved to make kselftest fail with
> similar splats. Can you check if this commit resolves that syzbot?

I missed that commit and didn't check the net-next git tree before
posting the patch. Yes, I think this commit will resolve the reported
problem. Thanks.
>
> thanks a lot!

Re: [PATCH] net/sched: unregister root_lock_key in the error path of qdisc_alloc()

[kernel test robot]

Hi Hou,

kernel test robot noticed the following build errors:

[auto build test ERROR on v6.9]
[cannot apply to net/main net-next/main linus/master next-20240517]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Hou-Tao/net-sched-unregister-root_lock_key-in-the-error-path-of-qdisc_alloc/20240516-213538
base:   v6.9
patch link:    https://lore.kernel.org/r/20240516133035.1050113-1-houtao%40huaweicloud.com
patch subject: [PATCH] net/sched: unregister root_lock_key in the error path of qdisc_alloc()
config: openrisc-defconfig (https://download.01.org/0day-ci/archive/20240517/202405171311.SyRzzQjC-lkp@intel.com/config)
compiler: or1k-linux-gcc (GCC) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240517/202405171311.SyRzzQjC-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202405171311.SyRzzQjC-lkp@intel.com/

All errors (new ones prefixed by >>):

   net/sched/sch_generic.c: In function 'qdisc_alloc':
>> net/sched/sch_generic.c:983:36: error: 'struct Qdisc' has no member named 'root_lock_key'
     983 |         lockdep_unregister_key(&sch->root_lock_key);
         |                                    ^~


vim +983 net/sched/sch_generic.c

   924	
   925	struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
   926				  const struct Qdisc_ops *ops,
   927				  struct netlink_ext_ack *extack)
   928	{
   929		struct Qdisc *sch;
   930		unsigned int size = sizeof(*sch) + ops->priv_size;
   931		int err = -ENOBUFS;
   932		struct net_device *dev;
   933	
   934		if (!dev_queue) {
   935			NL_SET_ERR_MSG(extack, "No device queue given");
   936			err = -EINVAL;
   937			goto errout;
   938		}
   939	
   940		dev = dev_queue->dev;
   941		sch = kzalloc_node(size, GFP_KERNEL, netdev_queue_numa_node_read(dev_queue));
   942	
   943		if (!sch)
   944			goto errout;
   945		__skb_queue_head_init(&sch->gso_skb);
   946		__skb_queue_head_init(&sch->skb_bad_txq);
   947		gnet_stats_basic_sync_init(&sch->bstats);
   948		spin_lock_init(&sch->q.lock);
   949	
   950		if (ops->static_flags & TCQ_F_CPUSTATS) {
   951			sch->cpu_bstats =
   952				netdev_alloc_pcpu_stats(struct gnet_stats_basic_sync);
   953			if (!sch->cpu_bstats)
   954				goto errout1;
   955	
   956			sch->cpu_qstats = alloc_percpu(struct gnet_stats_queue);
   957			if (!sch->cpu_qstats) {
   958				free_percpu(sch->cpu_bstats);
   959				goto errout1;
   960			}
   961		}
   962	
   963		spin_lock_init(&sch->busylock);
   964		lockdep_set_class(&sch->busylock,
   965				  dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);
   966	
   967		/* seqlock has the same scope of busylock, for NOLOCK qdisc */
   968		spin_lock_init(&sch->seqlock);
   969		lockdep_set_class(&sch->seqlock,
   970				  dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);
   971	
   972		sch->ops = ops;
   973		sch->flags = ops->static_flags;
   974		sch->enqueue = ops->enqueue;
   975		sch->dequeue = ops->dequeue;
   976		sch->dev_queue = dev_queue;
   977		sch->owner = -1;
   978		netdev_hold(dev, &sch->dev_tracker, GFP_KERNEL);
   979		refcount_set(&sch->refcnt, 1);
   980	
   981		return sch;
   982	errout1:
 > 983		lockdep_unregister_key(&sch->root_lock_key);
   984		kfree(sch);
   985	errout:
   986		return ERR_PTR(err);
   987	}
   988	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] net/sched: unregister root_lock_key in the error path of qdisc_alloc()

[kernel test robot]

Hi Hou,

kernel test robot noticed the following build errors:

[auto build test ERROR on v6.9]
[cannot apply to net/main net-next/main linus/master next-20240517]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Hou-Tao/net-sched-unregister-root_lock_key-in-the-error-path-of-qdisc_alloc/20240516-213538
base:   v6.9
patch link:    https://lore.kernel.org/r/20240516133035.1050113-1-houtao%40huaweicloud.com
patch subject: [PATCH] net/sched: unregister root_lock_key in the error path of qdisc_alloc()
config: um-allnoconfig (https://download.01.org/0day-ci/archive/20240517/202405171402.nix3cdP7-lkp@intel.com/config)
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240517/202405171402.nix3cdP7-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202405171402.nix3cdP7-lkp@intel.com/

All errors (new ones prefixed by >>):

   In file included from net/sched/sch_generic.c:17:
   In file included from include/linux/netdevice.h:38:
   In file included from include/net/net_namespace.h:43:
   In file included from include/linux/skbuff.h:17:
   In file included from include/linux/bvec.h:10:
   In file included from include/linux/highmem.h:12:
   In file included from include/linux/hardirq.h:11:
   In file included from arch/um/include/asm/hardirq.h:5:
   In file included from include/asm-generic/hardirq.h:17:
   In file included from include/linux/irq.h:20:
   In file included from include/linux/io.h:13:
   In file included from arch/um/include/asm/io.h:24:
   include/asm-generic/io.h:547:31: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     547 |         val = __raw_readb(PCI_IOBASE + addr);
         |                           ~~~~~~~~~~ ^
   include/asm-generic/io.h:560:61: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     560 |         val = __le16_to_cpu((__le16 __force)__raw_readw(PCI_IOBASE + addr));
         |                                                         ~~~~~~~~~~ ^
   include/uapi/linux/byteorder/little_endian.h:37:51: note: expanded from macro '__le16_to_cpu'
      37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x))
         |                                                   ^
   In file included from net/sched/sch_generic.c:17:
   In file included from include/linux/netdevice.h:38:
   In file included from include/net/net_namespace.h:43:
   In file included from include/linux/skbuff.h:17:
   In file included from include/linux/bvec.h:10:
   In file included from include/linux/highmem.h:12:
   In file included from include/linux/hardirq.h:11:
   In file included from arch/um/include/asm/hardirq.h:5:
   In file included from include/asm-generic/hardirq.h:17:
   In file included from include/linux/irq.h:20:
   In file included from include/linux/io.h:13:
   In file included from arch/um/include/asm/io.h:24:
   include/asm-generic/io.h:573:61: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     573 |         val = __le32_to_cpu((__le32 __force)__raw_readl(PCI_IOBASE + addr));
         |                                                         ~~~~~~~~~~ ^
   include/uapi/linux/byteorder/little_endian.h:35:51: note: expanded from macro '__le32_to_cpu'
      35 | #define __le32_to_cpu(x) ((__force __u32)(__le32)(x))
         |                                                   ^
   In file included from net/sched/sch_generic.c:17:
   In file included from include/linux/netdevice.h:38:
   In file included from include/net/net_namespace.h:43:
   In file included from include/linux/skbuff.h:17:
   In file included from include/linux/bvec.h:10:
   In file included from include/linux/highmem.h:12:
   In file included from include/linux/hardirq.h:11:
   In file included from arch/um/include/asm/hardirq.h:5:
   In file included from include/asm-generic/hardirq.h:17:
   In file included from include/linux/irq.h:20:
   In file included from include/linux/io.h:13:
   In file included from arch/um/include/asm/io.h:24:
   include/asm-generic/io.h:584:33: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     584 |         __raw_writeb(value, PCI_IOBASE + addr);
         |                             ~~~~~~~~~~ ^
   include/asm-generic/io.h:594:59: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     594 |         __raw_writew((u16 __force)cpu_to_le16(value), PCI_IOBASE + addr);
         |                                                       ~~~~~~~~~~ ^
   include/asm-generic/io.h:604:59: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     604 |         __raw_writel((u32 __force)cpu_to_le32(value), PCI_IOBASE + addr);
         |                                                       ~~~~~~~~~~ ^
   include/asm-generic/io.h:692:20: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     692 |         readsb(PCI_IOBASE + addr, buffer, count);
         |                ~~~~~~~~~~ ^
   include/asm-generic/io.h:700:20: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     700 |         readsw(PCI_IOBASE + addr, buffer, count);
         |                ~~~~~~~~~~ ^
   include/asm-generic/io.h:708:20: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     708 |         readsl(PCI_IOBASE + addr, buffer, count);
         |                ~~~~~~~~~~ ^
   include/asm-generic/io.h:717:21: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     717 |         writesb(PCI_IOBASE + addr, buffer, count);
         |                 ~~~~~~~~~~ ^
   include/asm-generic/io.h:726:21: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     726 |         writesw(PCI_IOBASE + addr, buffer, count);
         |                 ~~~~~~~~~~ ^
   include/asm-generic/io.h:735:21: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
     735 |         writesl(PCI_IOBASE + addr, buffer, count);
         |                 ~~~~~~~~~~ ^
>> net/sched/sch_generic.c:983:31: error: no member named 'root_lock_key' in 'struct Qdisc'
     983 |         lockdep_unregister_key(&sch->root_lock_key);
         |                                 ~~~  ^
   12 warnings and 1 error generated.


vim +983 net/sched/sch_generic.c

   924	
   925	struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
   926				  const struct Qdisc_ops *ops,
   927				  struct netlink_ext_ack *extack)
   928	{
   929		struct Qdisc *sch;
   930		unsigned int size = sizeof(*sch) + ops->priv_size;
   931		int err = -ENOBUFS;
   932		struct net_device *dev;
   933	
   934		if (!dev_queue) {
   935			NL_SET_ERR_MSG(extack, "No device queue given");
   936			err = -EINVAL;
   937			goto errout;
   938		}
   939	
   940		dev = dev_queue->dev;
   941		sch = kzalloc_node(size, GFP_KERNEL, netdev_queue_numa_node_read(dev_queue));
   942	
   943		if (!sch)
   944			goto errout;
   945		__skb_queue_head_init(&sch->gso_skb);
   946		__skb_queue_head_init(&sch->skb_bad_txq);
   947		gnet_stats_basic_sync_init(&sch->bstats);
   948		spin_lock_init(&sch->q.lock);
   949	
   950		if (ops->static_flags & TCQ_F_CPUSTATS) {
   951			sch->cpu_bstats =
   952				netdev_alloc_pcpu_stats(struct gnet_stats_basic_sync);
   953			if (!sch->cpu_bstats)
   954				goto errout1;
   955	
   956			sch->cpu_qstats = alloc_percpu(struct gnet_stats_queue);
   957			if (!sch->cpu_qstats) {
   958				free_percpu(sch->cpu_bstats);
   959				goto errout1;
   960			}
   961		}
   962	
   963		spin_lock_init(&sch->busylock);
   964		lockdep_set_class(&sch->busylock,
   965				  dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);
   966	
   967		/* seqlock has the same scope of busylock, for NOLOCK qdisc */
   968		spin_lock_init(&sch->seqlock);
   969		lockdep_set_class(&sch->seqlock,
   970				  dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);
   971	
   972		sch->ops = ops;
   973		sch->flags = ops->static_flags;
   974		sch->enqueue = ops->enqueue;
   975		sch->dequeue = ops->dequeue;
   976		sch->dev_queue = dev_queue;
   977		sch->owner = -1;
   978		netdev_hold(dev, &sch->dev_tracker, GFP_KERNEL);
   979		refcount_set(&sch->refcnt, 1);
   980	
   981		return sch;
   982	errout1:
 > 983		lockdep_unregister_key(&sch->root_lock_key);
   984		kfree(sch);
   985	errout:
   986		return ERR_PTR(err);
   987	}
   988	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki