From: Damien Le Moal <Damien.LeMoal@wdc.com> To: Colin Ian King <colin.king@canonical.com> Cc: Alasdair Kergon <agk@redhat.com>, Mike Snitzer <snitzer@redhat.com>, "dm-devel@redhat.com" <dm-devel@redhat.com>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org> Subject: Re: dm: Forbid requeue of writes to zones Date: Fri, 4 Jun 2021 00:08:47 +0000 [thread overview] Message-ID: <DM6PR04MB708127E21C618C8F5F6B3DB6E73B9@DM6PR04MB7081.namprd04.prod.outlook.com> (raw) In-Reply-To: 7e7530a9-7939-2ad6-bfe1-d3aeeeed1f77@canonical.com On 2021/06/04 7:17, Colin Ian King wrote: > Hi, > > Static analysis with Coverity on Linux next has found and issue in > drivers/md/dm.c with the following commit: > > commit 2c243153d1d4be4e23735cd10984ac17c7a54531 > Author: Damien Le Moal <damien.lemoal@wdc.com> > Date: Wed May 26 06:24:58 2021 +0900 > > dm: Forbid requeue of writes to zones > > The analysis is as follows: > > 828 static void dec_pending(struct dm_io *io, blk_status_t error) > 829 { > 830 unsigned long flags; > 831 blk_status_t io_error; > > 1. var_decl: Declaring variable bio without initializer. This one is related to #7. > > 832 struct bio *bio; > 833 struct mapped_device *md = io->md; > 834 > 835 /* Push-back supersedes any I/O errors */ > > 2. Condition !!error, taking true branch. > > 836 if (unlikely(error)) { > 837 spin_lock_irqsave(&io->endio_lock, flags); > > 3. Condition io->status == 11 /* (blk_status_t)11 */, taking false > branch. > > 838 if (!(io->status == BLK_STS_DM_REQUEUE && > __noflush_suspending(md))) > 839 io->status = error; > 840 spin_unlock_irqrestore(&io->endio_lock, flags); > 841 } > 842 My patch does not touch these hunks. They are as is. So that is not new. > > 4. Condition atomic_dec_and_test(&io->io_count), taking true branch. > > 843 if (atomic_dec_and_test(&io->io_count)) { > > 5. Condition io->status == 11 /* (blk_status_t)11 */, taking true > branch. > > 844 if (io->status == BLK_STS_DM_REQUEUE) { > 845 /* > 846 * Target requested pushing back the I/O. > 847 */ > 848 spin_lock_irqsave(&md->deferred_lock, flags); > > 6. Condition __noflush_suspending(md), taking true branch. > > 849 if (__noflush_suspending(md) && I do not understand this one, nor #4. > > Uninitialized pointer read > 7. uninit_use_in_call: Using uninitialized value bio when calling > dm_is_zone_write. > > 850 !WARN_ON_ONCE(dm_is_zone_write(md, bio))) > 851 /* NOTE early return due to > BLK_STS_DM_REQUEUE below */ > 852 bio_list_add_head(&md->deferred, > io->orig_bio); The kernel build robot signaled this one already. Will send an incremental patch asap today. > > The pointer bio is not initialized and yet is being used in the call to > function dm_is_zone_write where pointer bio is being accessed. I'm not > sure what the original intent was, but this looks incorrect. > > Colin > -- Damien Le Moal Western Digital Research
WARNING: multiple messages have this Message-ID (diff)
From: Damien Le Moal <Damien.LeMoal@wdc.com> To: Colin Ian King <colin.king@canonical.com> Cc: "dm-devel@redhat.com" <dm-devel@redhat.com>, Mike Snitzer <snitzer@redhat.com>, Alasdair Kergon <agk@redhat.com>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org> Subject: Re: [dm-devel] dm: Forbid requeue of writes to zones Date: Fri, 4 Jun 2021 00:08:47 +0000 [thread overview] Message-ID: <DM6PR04MB708127E21C618C8F5F6B3DB6E73B9@DM6PR04MB7081.namprd04.prod.outlook.com> (raw) In-Reply-To: 7e7530a9-7939-2ad6-bfe1-d3aeeeed1f77@canonical.com On 2021/06/04 7:17, Colin Ian King wrote: > Hi, > > Static analysis with Coverity on Linux next has found and issue in > drivers/md/dm.c with the following commit: > > commit 2c243153d1d4be4e23735cd10984ac17c7a54531 > Author: Damien Le Moal <damien.lemoal@wdc.com> > Date: Wed May 26 06:24:58 2021 +0900 > > dm: Forbid requeue of writes to zones > > The analysis is as follows: > > 828 static void dec_pending(struct dm_io *io, blk_status_t error) > 829 { > 830 unsigned long flags; > 831 blk_status_t io_error; > > 1. var_decl: Declaring variable bio without initializer. This one is related to #7. > > 832 struct bio *bio; > 833 struct mapped_device *md = io->md; > 834 > 835 /* Push-back supersedes any I/O errors */ > > 2. Condition !!error, taking true branch. > > 836 if (unlikely(error)) { > 837 spin_lock_irqsave(&io->endio_lock, flags); > > 3. Condition io->status == 11 /* (blk_status_t)11 */, taking false > branch. > > 838 if (!(io->status == BLK_STS_DM_REQUEUE && > __noflush_suspending(md))) > 839 io->status = error; > 840 spin_unlock_irqrestore(&io->endio_lock, flags); > 841 } > 842 My patch does not touch these hunks. They are as is. So that is not new. > > 4. Condition atomic_dec_and_test(&io->io_count), taking true branch. > > 843 if (atomic_dec_and_test(&io->io_count)) { > > 5. Condition io->status == 11 /* (blk_status_t)11 */, taking true > branch. > > 844 if (io->status == BLK_STS_DM_REQUEUE) { > 845 /* > 846 * Target requested pushing back the I/O. > 847 */ > 848 spin_lock_irqsave(&md->deferred_lock, flags); > > 6. Condition __noflush_suspending(md), taking true branch. > > 849 if (__noflush_suspending(md) && I do not understand this one, nor #4. > > Uninitialized pointer read > 7. uninit_use_in_call: Using uninitialized value bio when calling > dm_is_zone_write. > > 850 !WARN_ON_ONCE(dm_is_zone_write(md, bio))) > 851 /* NOTE early return due to > BLK_STS_DM_REQUEUE below */ > 852 bio_list_add_head(&md->deferred, > io->orig_bio); The kernel build robot signaled this one already. Will send an incremental patch asap today. > > The pointer bio is not initialized and yet is being used in the call to > function dm_is_zone_write where pointer bio is being accessed. I'm not > sure what the original intent was, but this looks incorrect. > > Colin > -- Damien Le Moal Western Digital Research -- dm-devel mailing list dm-devel@redhat.com https://listman.redhat.com/mailman/listinfo/dm-devel
next prev parent reply other threads:[~2021-06-04 0:08 UTC|newest] Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-06-03 22:17 dm: Forbid requeue of writes to zones Colin Ian King 2021-06-03 22:17 ` [dm-devel] " Colin Ian King 2021-06-04 0:08 ` Damien Le Moal [this message] 2021-06-04 0:08 ` Damien Le Moal
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=DM6PR04MB708127E21C618C8F5F6B3DB6E73B9@DM6PR04MB7081.namprd04.prod.outlook.com \ --to=damien.lemoal@wdc.com \ --cc=agk@redhat.com \ --cc=colin.king@canonical.com \ --cc=dm-devel@redhat.com \ --cc=linux-kernel@vger.kernel.org \ --cc=snitzer@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.