Re: [RFC 2/3] blktrace: fix debugfs use after free

[kbuild test robot <lkp@intel.com>]

[-- Attachment #1: Type: text/plain, Size: 4809 bytes --]

Hi Luis,

[FYI, it's a private test report for your RFC patch.]
[auto build test ERROR on block/for-next]
[also build test ERROR on linus/master next-20200403]
[cannot apply to linux/master v5.6]
[if your patch is applied to the wrong git tree, please drop us a note to help
improve the system. BTW, we also suggest to use '--base' option to specify the
base tree in git format-patch, please see https://stackoverflow.com/a/37406982]

url:    https://github.com/0day-ci/linux/commits/Luis-Chamberlain/block-address-blktrace-use-after-free/20200402-080202
base:   https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git for-next
config: x86_64-randconfig-d003-20200403 (attached as .config)
compiler: clang version 11.0.0 (https://github.com/llvm/llvm-project f68cc2a7ed766965028b8b0f0d9300a0460c3cf1)
reproduce:
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # save the attached .config to linux build tree
        COMPILER=clang make.cross ARCH=x86_64 

If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

>> kernel/trace/blktrace.c:486:10: error: no member named 'debugfs_dir' in 'struct request_queue'
           if (!q->debugfs_dir)
                ~  ^
   kernel/trace/blktrace.c:519:16: error: no member named 'debugfs_dir' in 'struct request_queue'
                                                  q->debugfs_dir, bt,
                                                  ~  ^
   kernel/trace/blktrace.c:522:53: error: no member named 'debugfs_dir' in 'struct request_queue'
           bt->msg_file = debugfs_create_file("msg", 0222, q->debugfs_dir,
                                                           ~  ^
   kernel/trace/blktrace.c:525:37: error: no member named 'debugfs_dir' in 'struct request_queue'
           bt->rchan = relay_open("trace", q->debugfs_dir, buts->buf_size,
                                           ~  ^
   4 errors generated.

vim +486 kernel/trace/blktrace.c

   469	
   470	/*
   471	 * Setup everything required to start tracing
   472	 */
   473	static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
   474				      struct block_device *bdev,
   475				      struct blk_user_trace_setup *buts)
   476	{
   477		struct blk_trace *bt = NULL;
   478		int ret;
   479	
   480		if (!buts->buf_size || !buts->buf_nr)
   481			return -EINVAL;
   482	
   483		if (!blk_debugfs_root)
   484			return -ENOENT;
   485	
 > 486		if (!q->debugfs_dir)
   487			return -ENOENT;
   488	
   489		strncpy(buts->name, name, BLKTRACE_BDEV_SIZE);
   490		buts->name[BLKTRACE_BDEV_SIZE - 1] = '\0';
   491	
   492		/*
   493		 * some device names have larger paths - convert the slashes
   494		 * to underscores for this to work as expected
   495		 */
   496		strreplace(buts->name, '/', '_');
   497	
   498		bt = kzalloc(sizeof(*bt), GFP_KERNEL);
   499		if (!bt)
   500			return -ENOMEM;
   501	
   502		ret = -ENOMEM;
   503		bt->sequence = alloc_percpu(unsigned long);
   504		if (!bt->sequence)
   505			goto err;
   506	
   507		bt->msg_data = __alloc_percpu(BLK_TN_MAX_MSG, __alignof__(char));
   508		if (!bt->msg_data)
   509			goto err;
   510	
   511		ret = -ENOENT;
   512	
   513		bt->dev = dev;
   514		atomic_set(&bt->dropped, 0);
   515		INIT_LIST_HEAD(&bt->running_list);
   516	
   517		ret = -EIO;
   518		bt->dropped_file = debugfs_create_file("dropped", 0444,
   519						       q->debugfs_dir, bt,
   520						       &blk_dropped_fops);
   521	
   522		bt->msg_file = debugfs_create_file("msg", 0222, q->debugfs_dir,
   523						   bt, &blk_msg_fops);
   524	
   525		bt->rchan = relay_open("trace", q->debugfs_dir, buts->buf_size,
   526					buts->buf_nr, &blk_relay_callbacks, bt);
   527		if (!bt->rchan)
   528			goto err;
   529	
   530		bt->act_mask = buts->act_mask;
   531		if (!bt->act_mask)
   532			bt->act_mask = (u16) -1;
   533	
   534		blk_trace_setup_lba(bt, bdev);
   535	
   536		/* overwrite with user settings */
   537		if (buts->start_lba)
   538			bt->start_lba = buts->start_lba;
   539		if (buts->end_lba)
   540			bt->end_lba = buts->end_lba;
   541	
   542		bt->pid = buts->pid;
   543		bt->trace_state = Blktrace_setup;
   544	
   545		ret = -EBUSY;
   546		if (cmpxchg(&q->blk_trace, NULL, bt))
   547			goto err;
   548	
   549		get_probe_ref();
   550	
   551		ret = 0;
   552	err:
   553		if (ret)
   554			blk_trace_free(bt);
   555		return ret;
   556	}
   557	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 36086 bytes --]