[bug report] netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict sequence

[bug report] netfs: Fix unbuffered/DIO writes to dispatch subrequests in strict sequence

[Dan Carpenter]

Hello David Howells,

Commit a0b4c7a49137 ("netfs: Fix unbuffered/DIO writes to dispatch
subrequests in strict sequence") from Feb 26, 2026 (linux-next),
leads to the following Smatch static checker warning:

	fs/netfs/direct_write.c:203 netfs_unbuffered_write()
	error: uninitialized symbol 'ret'.

fs/netfs/direct_write.c
    94 static int netfs_unbuffered_write(struct netfs_io_request *wreq)
    95 {
    96         struct netfs_io_subrequest *subreq = NULL;
    97         struct netfs_io_stream *stream = &wreq->io_streams[0];
    98         int ret;
    99 
    100         _enter("%llx", wreq->len);
    101 
    102         if (wreq->origin == NETFS_DIO_WRITE)
    103                 inode_dio_begin(wreq->inode);
    104 
    105         stream->collected_to = wreq->start;
    106 
    107         for (;;) {
    108                 bool retry = false;
    109 
    110                 if (!subreq) {
    111                         netfs_prepare_write(wreq, stream, wreq->start + wreq->transferred);
    112                         subreq = stream->construct;
    113                         stream->construct = NULL;
    114                 }
    115 
    116                 /* Check if (re-)preparation failed. */
    117                 if (unlikely(test_bit(NETFS_SREQ_FAILED, &subreq->flags))) {
    118                         netfs_write_subrequest_terminated(subreq, subreq->error);
    119                         wreq->error = subreq->error;
    120                         break;

If we break on the first iteration

    121                 }
    122 
    123                 iov_iter_truncate(&subreq->io_iter, wreq->len - wreq->transferred);
    124                 if (!iov_iter_count(&subreq->io_iter))
    125                         break;

or here

    126 
    127                 subreq->len = netfs_limit_iter(&subreq->io_iter, 0,
    128                                                stream->sreq_max_len,
    129                                                stream->sreq_max_segs);
    130                 iov_iter_truncate(&subreq->io_iter, subreq->len);
    131                 stream->submit_extendable_to = subreq->len;
    132 
    133                 trace_netfs_sreq(subreq, netfs_sreq_trace_submit);
    134                 stream->issue_write(subreq);
    135 
    136                 /* Async, need to wait. */
    137                 netfs_wait_for_in_progress_stream(wreq, stream);
    138 
    139                 if (test_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags)) {
    140                         retry = true;
    141                 } else if (test_bit(NETFS_SREQ_FAILED, &subreq->flags)) {
    142                         ret = subreq->error;
    143                         wreq->error = ret;
    144                         netfs_see_subrequest(subreq, netfs_sreq_trace_see_failed);
    145                         subreq = NULL;
    146                         break;
    147                 }
    148                 ret = 0;
    149 
    150                 if (!retry) {
    151                         netfs_unbuffered_write_collect(wreq, stream, subreq);
    152                         subreq = NULL;
    153                         if (wreq->transferred >= wreq->len)
    154                                 break;
    155                         if (!wreq->iocb && signal_pending(current)) {
    156                                 ret = wreq->transferred ? -EINTR : -ERESTARTSYS;
    157                                 trace_netfs_rreq(wreq, netfs_rreq_trace_intr);
    158                                 break;
    159                         }
    160                         continue;
    161                 }
    162 
    163                 /* We need to retry the last subrequest, so first reset the
    164                  * iterator, taking into account what, if anything, we managed
    165                  * to transfer.
    166                  */
    167                 subreq->error = -EAGAIN;
    168                 trace_netfs_sreq(subreq, netfs_sreq_trace_retry);
    169                 if (subreq->transferred > 0)
    170                         iov_iter_advance(&wreq->buffer.iter, subreq->transferred);
    171 
    172                 if (stream->source == NETFS_UPLOAD_TO_SERVER &&
    173                     wreq->netfs_ops->retry_request)
    174                         wreq->netfs_ops->retry_request(wreq, stream);
    175 
    176                 __clear_bit(NETFS_SREQ_NEED_RETRY, &subreq->flags);
    177                 __clear_bit(NETFS_SREQ_BOUNDARY, &subreq->flags);
    178                 __clear_bit(NETFS_SREQ_FAILED, &subreq->flags);
    179                 subreq->io_iter                = wreq->buffer.iter;
    180                 subreq->start                = wreq->start + wreq->transferred;
    181                 subreq->len                = wreq->len   - wreq->transferred;
    182                 subreq->transferred        = 0;
    183                 subreq->retry_count        += 1;
    184                 stream->sreq_max_len        = UINT_MAX;
    185                 stream->sreq_max_segs        = INT_MAX;
    186 
    187                 netfs_get_subrequest(subreq, netfs_sreq_trace_get_resubmit);
    188 
    189                 if (stream->prepare_write) {
    190                         stream->prepare_write(subreq);
    191                         __set_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags);
    192                         netfs_stat(&netfs_n_wh_retry_write_subreq);
    193                 } else {
    194                         struct iov_iter source;
    195 
    196                         netfs_reset_iter(subreq);
    197                         source = subreq->io_iter;
    198                         netfs_reissue_write(stream, subreq, &source);
    199                 }
    200         }
    201 
    202         netfs_unbuffered_write_done(wreq);
--> 203         _leave(" = %d", ret);
    204         return ret;

Then ret is uninitialized

    205 }

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter