[djwong-xfs:refactor-log-recovery 299/314] fs/xfs/xfs_buf_item.c:1372 xlog_recover_buffer_pass1() error: potential null dereference 'bcp'. (kmem_alloc returns null)

[djwong-xfs:refactor-log-recovery 299/314] fs/xfs/xfs_buf_item.c:1372 xlog_recover_buffer_pass1() error: potential null dereference 'bcp'. (kmem_alloc returns null)

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 3009 bytes --]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfs-linux.git refactor-log-recovery
head:   2dcdc305cfc2b8b1beee483cf8ae5c674d9fac86
commit: 06450afc33740b8a0d2d62b483595f9c11c0fb8b [299/314] xfs: refactor log recovery item dispatch for pass1 commit functions

If you fix the issue, kindly add following tag as appropriate
Reported-by: kbuild test robot <lkp@intel.com>

smatch warnings:
fs/xfs/xfs_buf_item.c:1372 xlog_recover_buffer_pass1() error: potential null dereference 'bcp'.  (kmem_alloc returns null)

vim +/bcp +1372 fs/xfs/xfs_buf_item.c

  1321	
  1322	/*
  1323	 * Build up the table of buf cancel records so that we don't replay
  1324	 * cancelled data in the second pass.  For buffer records that are
  1325	 * not cancel records, there is nothing to do here so we just return.
  1326	 *
  1327	 * If we get a cancel record which is already in the table, this indicates
  1328	 * that the buffer was cancelled multiple times.  In order to ensure
  1329	 * that during pass 2 we keep the record in the table until we reach its
  1330	 * last occurrence in the log, we keep a reference count in the cancel
  1331	 * record in the table to tell us how many times we expect to see this
  1332	 * record during the second pass.
  1333	 */
  1334	STATIC int
  1335	xlog_recover_buffer_pass1(
  1336		struct xlog			*log,
  1337		struct xlog_recover_item	*item)
  1338	{
  1339		xfs_buf_log_format_t	*buf_f = item->ri_buf[0].i_addr;
  1340		struct list_head	*bucket;
  1341		struct xfs_buf_cancel	*bcp;
  1342	
  1343		if (!xfs_buf_log_check_iovec(&item->ri_buf[0])) {
  1344			xfs_err(log->l_mp, "bad buffer log item size (%d)",
  1345					item->ri_buf[0].i_len);
  1346			return -EFSCORRUPTED;
  1347		}
  1348	
  1349		/*
  1350		 * If this isn't a cancel buffer item, then just return.
  1351		 */
  1352		if (!(buf_f->blf_flags & XFS_BLF_CANCEL)) {
  1353			trace_xfs_log_recover_buf_not_cancel(log, buf_f);
  1354			return 0;
  1355		}
  1356	
  1357		/*
  1358		 * Insert an xfs_buf_cancel record into the hash table of them.
  1359		 * If there is already an identical record, bump its reference count.
  1360		 */
  1361		bucket = XLOG_BUF_CANCEL_BUCKET(log, buf_f->blf_blkno);
  1362		list_for_each_entry(bcp, bucket, bc_list) {
  1363			if (bcp->bc_blkno == buf_f->blf_blkno &&
  1364			    bcp->bc_len == buf_f->blf_len) {
  1365				bcp->bc_refcount++;
  1366				trace_xfs_log_recover_buf_cancel_ref_inc(log, buf_f);
  1367				return 0;
  1368			}
  1369		}
  1370	
  1371		bcp = kmem_alloc(sizeof(struct xfs_buf_cancel), 0);
> 1372		bcp->bc_blkno = buf_f->blf_blkno;
  1373		bcp->bc_len = buf_f->blf_len;
  1374		bcp->bc_refcount = 1;
  1375		list_add_tail(&bcp->bc_list, bucket);
  1376	
  1377		trace_xfs_log_recover_buf_cancel_add(log, buf_f);
  1378		return 0;
  1379	}
  1380	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org