tree:   
https://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm.git 
for-next
head:   9c01fc7e4f3b269a5550014c16ba2fa15b90fc45
commit: 560e9814d061de1dce3328630846025d653dea7d [2/3] dm mpath: fix 
attached_handler_name leak and dangling hw_handler_name pointer
config: x86_64-randconfig-x019-201837 (attached as .config)
compiler: gcc-7 (Debian 7.3.0-1) 7.3.0
reproduce:
        git checkout 560e9814d061de1dce3328630846025d653dea7d
        # save the attached .config to linux build tree
        make ARCH=x86_64 

All error/warnings (new ones prefixed by >>):

   drivers/md/dm-mpath.c: In function 'setup_scsi_dh':
>> drivers/md/dm-mpath.c:821:37: error: passing argument 1 of 'strcmp' from 
>> incompatible pointer type [-Werror=incompatible-pointer-types]
       if (m->hw_handler_name && strcmp(attached_handler_name, 
m->hw_handler_name)) {
                                        ^~~~~~~~~~~~~~~~~~~~~
   In file included from include/linux/bitmap.h:9:0,
                    from include/linux/cpumask.h:12,
                    from arch/x86/include/asm/cpumask.h:5,
                    from arch/x86/include/asm/msr.h:11,
                    from arch/x86/include/asm/processor.h:21,
                    from arch/x86/include/asm/cpufeature.h:5,
                    from arch/x86/include/asm/thread_info.h:53,
                    from include/linux/thread_info.h:38,
                    from arch/x86/include/asm/preempt.h:7,
                    from include/linux/preempt.h:81,
                    from include/linux/spinlock.h:51,
                    from include/linux/wait.h:9,
                    from include/linux/wait_bit.h:8,
                    from include/linux/fs.h:6,
                    from include/linux/highmem.h:5,
                    from include/linux/bio.h:21,
                    from include/linux/device-mapper.h:11,
                    from drivers/md/dm-mpath.c:8:
   include/linux/string.h:44:12: note: expected 'const char *' but argument is 
of type 'char **'
    extern int strcmp(const char *,const char *);
               ^~~~~~
   drivers/md/dm-mpath.c: In function 'parse_path':
>> drivers/md/dm-mpath.c:891:24: warning: assignment discards 'const' qualifier 
>> from pointer target type [-Wdiscarded-qualifiers]
     attached_handler_name = scsi_dh_attached_handler_name(q, GFP_KERNEL);
                           ^
   cc1: some warnings being treated as errors

vim +/strcmp +821 drivers/md/dm-mpath.c

^1da177e Linus Torvalds      2005-04-16  807  
e8f74a0f Mike Snitzer        2018-03-12  808  static int setup_scsi_dh(struct 
block_device *bdev, struct multipath *m,
560e9814 Mike Snitzer        2018-09-17  809                     char 
**attached_handler_name, char **error)
^1da177e Linus Torvalds      2005-04-16  810  {
848b8aef Mike Snitzer        2017-12-10  811    struct request_queue *q = 
bdev_get_queue(bdev);
848b8aef Mike Snitzer        2017-12-10  812    int r;
a58a935d Mike Snitzer        2012-07-27  813  
518257b1 Mike Snitzer        2016-03-17  814    if 
(test_bit(MPATHF_RETAIN_ATTACHED_HW_HANDLER, &m->flags)) {
1bab0de0 Christoph Hellwig   2015-08-27  815  retain:
560e9814 Mike Snitzer        2018-09-17  816            if 
(*attached_handler_name) {
a58a935d Mike Snitzer        2012-07-27  817                    /*
54cd640d tang.junhui         2016-11-24  818                     * Clear any 
hw_handler_params associated with a
54cd640d tang.junhui         2016-11-24  819                     * handler that 
isn't already attached.
54cd640d tang.junhui         2016-11-24  820                     */
54cd640d tang.junhui         2016-11-24 @821                    if 
(m->hw_handler_name && strcmp(attached_handler_name, m->hw_handler_name)) {
54cd640d tang.junhui         2016-11-24  822                            
kfree(m->hw_handler_params);
54cd640d tang.junhui         2016-11-24  823                            
m->hw_handler_params = NULL;
54cd640d tang.junhui         2016-11-24  824                    }
54cd640d tang.junhui         2016-11-24  825  
54cd640d tang.junhui         2016-11-24  826                    /*
a58a935d Mike Snitzer        2012-07-27  827                     * Reset 
hw_handler_name to match the attached handler
a58a935d Mike Snitzer        2012-07-27  828                     *
a58a935d Mike Snitzer        2012-07-27  829                     * NB. This 
modifies the table line to show the actual
a58a935d Mike Snitzer        2012-07-27  830                     * handler 
instead of the original table passed in.
a58a935d Mike Snitzer        2012-07-27  831                     */
a58a935d Mike Snitzer        2012-07-27  832                    
kfree(m->hw_handler_name);
560e9814 Mike Snitzer        2018-09-17  833                    
m->hw_handler_name = *attached_handler_name;
560e9814 Mike Snitzer        2018-09-17  834                    
*attached_handler_name = NULL;
a58a935d Mike Snitzer        2012-07-27  835            }
a58a935d Mike Snitzer        2012-07-27  836    }
a0cf7ea9 Hannes Reinecke     2009-06-22  837  
a58a935d Mike Snitzer        2012-07-27  838    if (m->hw_handler_name) {
a0cf7ea9 Hannes Reinecke     2009-06-22  839            r = scsi_dh_attach(q, 
m->hw_handler_name);
a0cf7ea9 Hannes Reinecke     2009-06-22  840            if (r == -EBUSY) {
1bab0de0 Christoph Hellwig   2015-08-27  841                    char 
b[BDEVNAME_SIZE];
a0cf7ea9 Hannes Reinecke     2009-06-22  842  
1bab0de0 Christoph Hellwig   2015-08-27  843                    
printk(KERN_INFO "dm-mpath: retaining handler on device %s\n",
848b8aef Mike Snitzer        2017-12-10  844                           
bdevname(bdev, b));
1bab0de0 Christoph Hellwig   2015-08-27  845                    goto retain;
1bab0de0 Christoph Hellwig   2015-08-27  846            }
ae11b1b3 Hannes Reinecke     2008-07-17  847            if (r < 0) {
848b8aef Mike Snitzer        2017-12-10  848                    *error = "error 
attaching hardware handler";
848b8aef Mike Snitzer        2017-12-10  849                    return r;
ae11b1b3 Hannes Reinecke     2008-07-17  850            }
2bfd2e13 Chandra Seetharaman 2009-08-03  851  
2bfd2e13 Chandra Seetharaman 2009-08-03  852            if 
(m->hw_handler_params) {
2bfd2e13 Chandra Seetharaman 2009-08-03  853                    r = 
scsi_dh_set_params(q, m->hw_handler_params);
2bfd2e13 Chandra Seetharaman 2009-08-03  854                    if (r < 0) {
848b8aef Mike Snitzer        2017-12-10  855                            *error 
= "unable to set hardware handler parameters";
848b8aef Mike Snitzer        2017-12-10  856                            return 
r;
848b8aef Mike Snitzer        2017-12-10  857                    }
848b8aef Mike Snitzer        2017-12-10  858            }
848b8aef Mike Snitzer        2017-12-10  859    }
848b8aef Mike Snitzer        2017-12-10  860  
848b8aef Mike Snitzer        2017-12-10  861    return 0;
848b8aef Mike Snitzer        2017-12-10  862  }
848b8aef Mike Snitzer        2017-12-10  863  
848b8aef Mike Snitzer        2017-12-10  864  static struct pgpath 
*parse_path(struct dm_arg_set *as, struct path_selector *ps,
848b8aef Mike Snitzer        2017-12-10  865                             struct 
dm_target *ti)
848b8aef Mike Snitzer        2017-12-10  866  {
848b8aef Mike Snitzer        2017-12-10  867    int r;
848b8aef Mike Snitzer        2017-12-10  868    struct pgpath *p;
848b8aef Mike Snitzer        2017-12-10  869    struct multipath *m = 
ti->private;
e8f74a0f Mike Snitzer        2018-03-12  870    struct request_queue *q;
560e9814 Mike Snitzer        2018-09-17  871    char *attached_handler_name = 
NULL;
848b8aef Mike Snitzer        2017-12-10  872  
848b8aef Mike Snitzer        2017-12-10  873    /* we need at least a path arg 
*/
848b8aef Mike Snitzer        2017-12-10  874    if (as->argc < 1) {
848b8aef Mike Snitzer        2017-12-10  875            ti->error = "no device 
given";
848b8aef Mike Snitzer        2017-12-10  876            return ERR_PTR(-EINVAL);
848b8aef Mike Snitzer        2017-12-10  877    }
848b8aef Mike Snitzer        2017-12-10  878  
848b8aef Mike Snitzer        2017-12-10  879    p = alloc_pgpath();
848b8aef Mike Snitzer        2017-12-10  880    if (!p)
848b8aef Mike Snitzer        2017-12-10  881            return ERR_PTR(-ENOMEM);
848b8aef Mike Snitzer        2017-12-10  882  
848b8aef Mike Snitzer        2017-12-10  883    r = dm_get_device(ti, 
dm_shift_arg(as), dm_table_get_mode(ti->table),
848b8aef Mike Snitzer        2017-12-10  884                      &p->path.dev);
848b8aef Mike Snitzer        2017-12-10  885    if (r) {
848b8aef Mike Snitzer        2017-12-10  886            ti->error = "error 
getting device";
2bfd2e13 Chandra Seetharaman 2009-08-03  887            goto bad;
2bfd2e13 Chandra Seetharaman 2009-08-03  888    }
848b8aef Mike Snitzer        2017-12-10  889  
e8f74a0f Mike Snitzer        2018-03-12  890    q = 
bdev_get_queue(p->path.dev->bdev);
e8f74a0f Mike Snitzer        2018-03-12 @891    attached_handler_name = 
scsi_dh_attached_handler_name(q, GFP_KERNEL);
e457edf0 Mike Snitzer        2018-03-29  892    if (attached_handler_name || 
m->hw_handler_name) {
848b8aef Mike Snitzer        2017-12-10  893            
INIT_DELAYED_WORK(&p->activate_path, activate_path_work);
560e9814 Mike Snitzer        2018-09-17  894            r = 
setup_scsi_dh(p->path.dev->bdev, m, &attached_handler_name, &ti->error);
848b8aef Mike Snitzer        2017-12-10  895            if (r) {
848b8aef Mike Snitzer        2017-12-10  896                    
dm_put_device(ti, p->path.dev);
848b8aef Mike Snitzer        2017-12-10  897                    goto bad;
2bfd2e13 Chandra Seetharaman 2009-08-03  898            }
ae11b1b3 Hannes Reinecke     2008-07-17  899    }
ae11b1b3 Hannes Reinecke     2008-07-17  900  
^1da177e Linus Torvalds      2005-04-16  901    r = ps->type->add_path(ps, 
&p->path, as->argc, as->argv, &ti->error);
^1da177e Linus Torvalds      2005-04-16  902    if (r) {
^1da177e Linus Torvalds      2005-04-16  903            dm_put_device(ti, 
p->path.dev);
^1da177e Linus Torvalds      2005-04-16  904            goto bad;
^1da177e Linus Torvalds      2005-04-16  905    }
^1da177e Linus Torvalds      2005-04-16  906  
^1da177e Linus Torvalds      2005-04-16  907    return p;
^1da177e Linus Torvalds      2005-04-16  908   bad:
560e9814 Mike Snitzer        2018-09-17  909    kfree(attached_handler_name);
^1da177e Linus Torvalds      2005-04-16  910    free_pgpath(p);
01460f35 Benjamin Marzinski  2008-10-10  911    return ERR_PTR(r);
^1da177e Linus Torvalds      2005-04-16  912  }
^1da177e Linus Torvalds      2005-04-16  913  

:::::: The code at line 821 was first introduced by commit
:::::: 54cd640d20de46bb54747286ca19f3995be921f2 dm mpath: use hw_handler_params 
if attached hw_handler is same as requested

:::::: TO: tang.junhui <[email protected]>
:::::: CC: Mike Snitzer <[email protected]>

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

Attachment: .config.gz
Description: application/gzip

--
dm-devel mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/dm-devel

Reply via email to