All of lore.kernel.org
 help / color / mirror / Atom feed
* [sashal-stable:pending-4.9 24/47] drivers/vhost/vsock.c:370:7: warning: variable 'len' set but not used
@ 2021-12-04  4:00 kernel test robot
  0 siblings, 0 replies; only message in thread
From: kernel test robot @ 2021-12-04  4:00 UTC (permalink / raw)
  To: kbuild-all

[-- Attachment #1: Type: text/plain, Size: 7154 bytes --]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git pending-4.9
head:   c79d46dbf36c62d56132014e5ac73763b3fa366c
commit: dfca68639dfdd617fdc7aa387a3b6df1037dc135 [24/47] vhost/vsock: fix incorrect used length reported to the guest
config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20211204/202112041131.DNVmpN4Q-lkp(a)intel.com/config)
compiler: gcc-7 (Ubuntu 7.5.0-6ubuntu2) 7.5.0
reproduce (this is a W=1 build):
        # https://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git/commit/?id=dfca68639dfdd617fdc7aa387a3b6df1037dc135
        git remote add sashal-stable https://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git
        git fetch --no-tags sashal-stable pending-4.9
        git checkout dfca68639dfdd617fdc7aa387a3b6df1037dc135
        # save the config file to linux build tree
        mkdir build_dir
        make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash LDFLAGS=-z max-page-size=0x200000  drivers/vhost/

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All warnings (new ones prefixed by >>):

   drivers/vhost/vsock.c: In function 'vhost_transport_send_pkt':
   drivers/vhost/vsock.c:207:26: warning: variable 'vq' set but not used [-Wunused-but-set-variable]
     struct vhost_virtqueue *vq;
                             ^~
   drivers/vhost/vsock.c: In function 'vhost_vsock_handle_tx_kick':
>> drivers/vhost/vsock.c:370:7: warning: variable 'len' set but not used [-Wunused-but-set-variable]
      u32 len;
          ^~~


vim +/len +370 drivers/vhost/vsock.c

433fc58e6bf2c8 Asias He           2016-07-28  351  
433fc58e6bf2c8 Asias He           2016-07-28  352  static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
433fc58e6bf2c8 Asias He           2016-07-28  353  {
433fc58e6bf2c8 Asias He           2016-07-28  354  	struct vhost_virtqueue *vq = container_of(work, struct vhost_virtqueue,
433fc58e6bf2c8 Asias He           2016-07-28  355  						  poll.work);
433fc58e6bf2c8 Asias He           2016-07-28  356  	struct vhost_vsock *vsock = container_of(vq->dev, struct vhost_vsock,
433fc58e6bf2c8 Asias He           2016-07-28  357  						 dev);
433fc58e6bf2c8 Asias He           2016-07-28  358  	struct virtio_vsock_pkt *pkt;
433fc58e6bf2c8 Asias He           2016-07-28  359  	int head;
433fc58e6bf2c8 Asias He           2016-07-28  360  	unsigned int out, in;
433fc58e6bf2c8 Asias He           2016-07-28  361  	bool added = false;
433fc58e6bf2c8 Asias He           2016-07-28  362  
433fc58e6bf2c8 Asias He           2016-07-28  363  	mutex_lock(&vq->mutex);
433fc58e6bf2c8 Asias He           2016-07-28  364  
433fc58e6bf2c8 Asias He           2016-07-28  365  	if (!vq->private_data)
433fc58e6bf2c8 Asias He           2016-07-28  366  		goto out;
433fc58e6bf2c8 Asias He           2016-07-28  367  
433fc58e6bf2c8 Asias He           2016-07-28  368  	vhost_disable_notify(&vsock->dev, vq);
433fc58e6bf2c8 Asias He           2016-07-28  369  	for (;;) {
3fda5d6e580193 Stefan Hajnoczi    2016-08-04 @370  		u32 len;
3fda5d6e580193 Stefan Hajnoczi    2016-08-04  371  
433fc58e6bf2c8 Asias He           2016-07-28  372  		if (!vhost_vsock_more_replies(vsock)) {
433fc58e6bf2c8 Asias He           2016-07-28  373  			/* Stop tx until the device processes already
433fc58e6bf2c8 Asias He           2016-07-28  374  			 * pending replies.  Leave tx virtqueue
433fc58e6bf2c8 Asias He           2016-07-28  375  			 * callbacks disabled.
433fc58e6bf2c8 Asias He           2016-07-28  376  			 */
433fc58e6bf2c8 Asias He           2016-07-28  377  			goto no_more_replies;
433fc58e6bf2c8 Asias He           2016-07-28  378  		}
433fc58e6bf2c8 Asias He           2016-07-28  379  
433fc58e6bf2c8 Asias He           2016-07-28  380  		head = vhost_get_vq_desc(vq, vq->iov, ARRAY_SIZE(vq->iov),
433fc58e6bf2c8 Asias He           2016-07-28  381  					 &out, &in, NULL, NULL);
433fc58e6bf2c8 Asias He           2016-07-28  382  		if (head < 0)
433fc58e6bf2c8 Asias He           2016-07-28  383  			break;
433fc58e6bf2c8 Asias He           2016-07-28  384  
433fc58e6bf2c8 Asias He           2016-07-28  385  		if (head == vq->num) {
433fc58e6bf2c8 Asias He           2016-07-28  386  			if (unlikely(vhost_enable_notify(&vsock->dev, vq))) {
433fc58e6bf2c8 Asias He           2016-07-28  387  				vhost_disable_notify(&vsock->dev, vq);
433fc58e6bf2c8 Asias He           2016-07-28  388  				continue;
433fc58e6bf2c8 Asias He           2016-07-28  389  			}
433fc58e6bf2c8 Asias He           2016-07-28  390  			break;
433fc58e6bf2c8 Asias He           2016-07-28  391  		}
433fc58e6bf2c8 Asias He           2016-07-28  392  
433fc58e6bf2c8 Asias He           2016-07-28  393  		pkt = vhost_vsock_alloc_pkt(vq, out, in);
433fc58e6bf2c8 Asias He           2016-07-28  394  		if (!pkt) {
433fc58e6bf2c8 Asias He           2016-07-28  395  			vq_err(vq, "Faulted on pkt\n");
433fc58e6bf2c8 Asias He           2016-07-28  396  			continue;
433fc58e6bf2c8 Asias He           2016-07-28  397  		}
433fc58e6bf2c8 Asias He           2016-07-28  398  
3fda5d6e580193 Stefan Hajnoczi    2016-08-04  399  		len = pkt->len;
3fda5d6e580193 Stefan Hajnoczi    2016-08-04  400  
433fc58e6bf2c8 Asias He           2016-07-28  401  		/* Only accept correctly addressed packets */
0a8f421b7a2244 Stefano Garzarella 2019-12-06  402  		if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid &&
0a8f421b7a2244 Stefano Garzarella 2019-12-06  403  		    le64_to_cpu(pkt->hdr.dst_cid) ==
0a8f421b7a2244 Stefano Garzarella 2019-12-06  404  		    vhost_transport_get_local_cid())
433fc58e6bf2c8 Asias He           2016-07-28  405  			virtio_transport_recv_pkt(pkt);
433fc58e6bf2c8 Asias He           2016-07-28  406  		else
433fc58e6bf2c8 Asias He           2016-07-28  407  			virtio_transport_free_pkt(pkt);
433fc58e6bf2c8 Asias He           2016-07-28  408  
dfca68639dfdd6 Stefano Garzarella 2021-11-22  409  		vhost_add_used(vq, head, 0);
433fc58e6bf2c8 Asias He           2016-07-28  410  		added = true;
433fc58e6bf2c8 Asias He           2016-07-28  411  	}
433fc58e6bf2c8 Asias He           2016-07-28  412  
433fc58e6bf2c8 Asias He           2016-07-28  413  no_more_replies:
433fc58e6bf2c8 Asias He           2016-07-28  414  	if (added)
433fc58e6bf2c8 Asias He           2016-07-28  415  		vhost_signal(&vsock->dev, vq);
433fc58e6bf2c8 Asias He           2016-07-28  416  
433fc58e6bf2c8 Asias He           2016-07-28  417  out:
433fc58e6bf2c8 Asias He           2016-07-28  418  	mutex_unlock(&vq->mutex);
433fc58e6bf2c8 Asias He           2016-07-28  419  }
433fc58e6bf2c8 Asias He           2016-07-28  420  

:::::: The code at line 370 was first introduced by commit
:::::: 3fda5d6e580193fa005014355b3a61498f1b3ae0 vhost/vsock: fix vhost virtio_vsock_pkt use-after-free

:::::: TO: Stefan Hajnoczi <stefanha@redhat.com>
:::::: CC: Michael S. Tsirkin <mst@redhat.com>

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

^ permalink raw reply	[flat|nested] only message in thread
only message in thread, other threads:[~2021-12-04  4:00 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-12-04  4:00 [sashal-stable:pending-4.9 24/47] drivers/vhost/vsock.c:370:7: warning: variable 'len' set but not used kernel test robot

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.