CC: [email protected] TO: Douglas Gilbert <[email protected]> CC: "Martin K. Petersen" <[email protected]> CC: Hannes Reinecke <[email protected]>
Hi Douglas, First bad commit (maybe != root cause): tree: https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git for-next head: abb4c1c5b84a098fe932a1003e973287d1de7ed7 commit: 7323ad3618b615149ea25b3144f9a162668ef93b [202/203] scsi: sg: Replace rq array with xarray :::::: branch date: 2 days ago :::::: commit date: 2 days ago config: x86_64-randconfig-m001-20210125 (attached as .config) compiler: gcc-9 (Debian 9.3.0-20) 9.3.0 If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <[email protected]> Reported-by: Dan Carpenter <[email protected]> smatch warnings: drivers/scsi/sg.c:1570 sg_ctl_req_tbl() warn: maybe return -EFAULT instead of the bytes remaining? drivers/scsi/sg.c:2709 sg_mk_sgat() warn: always true condition '(--order >= 0) => (0-u32max >= 0)' vim +1570 drivers/scsi/sg.c fd6c3d5accea8e7e Arnd Bergmann 2018-08-24 1518 7323ad3618b61514 Douglas Gilbert 2021-01-13 1519 /* 7323ad3618b61514 Douglas Gilbert 2021-01-13 1520 * For backward compatibility, output SG_MAX_QUEUE sg_req_info objects. First 7323ad3618b61514 Douglas Gilbert 2021-01-13 1521 * fetch from the active list then, if there is still room, from the free 7323ad3618b61514 Douglas Gilbert 2021-01-13 1522 * list. Some of the trailing elements may be empty which is indicated by all 7323ad3618b61514 Douglas Gilbert 2021-01-13 1523 * fields being zero. Any requests beyond SG_MAX_QUEUE are ignored. 7323ad3618b61514 Douglas Gilbert 2021-01-13 1524 */ 59774702b44561f8 Douglas Gilbert 2021-01-13 1525 static int 59774702b44561f8 Douglas Gilbert 2021-01-13 1526 sg_ctl_req_tbl(struct sg_fd *sfp, void __user *p) 59774702b44561f8 Douglas Gilbert 2021-01-13 1527 { 7323ad3618b61514 Douglas Gilbert 2021-01-13 1528 int k, result, val; 94d73d8ae7d08375 Douglas Gilbert 2021-01-13 1529 unsigned long idx; b6d556343c7bbcc4 Douglas Gilbert 2021-01-13 1530 struct sg_request *srp; 7323ad3618b61514 Douglas Gilbert 2021-01-13 1531 struct sg_req_info *rinfop; 59774702b44561f8 Douglas Gilbert 2021-01-13 1532 7323ad3618b61514 Douglas Gilbert 2021-01-13 1533 SG_LOG(3, sfp, "%s: SG_GET_REQUEST_TABLE\n", __func__); 7323ad3618b61514 Douglas Gilbert 2021-01-13 1534 k = SG_MAX_QUEUE; 7323ad3618b61514 Douglas Gilbert 2021-01-13 1535 rinfop = kcalloc(k, SZ_SG_REQ_INFO, GFP_KERNEL); b6d556343c7bbcc4 Douglas Gilbert 2021-01-13 1536 if (!rinfop) 59774702b44561f8 Douglas Gilbert 2021-01-13 1537 return -ENOMEM; b6d556343c7bbcc4 Douglas Gilbert 2021-01-13 1538 val = 0; 94d73d8ae7d08375 Douglas Gilbert 2021-01-13 1539 xa_for_each(&sfp->srp_arr, idx, srp) { 94d73d8ae7d08375 Douglas Gilbert 2021-01-13 1540 if (!srp) 94d73d8ae7d08375 Douglas Gilbert 2021-01-13 1541 continue; 7323ad3618b61514 Douglas Gilbert 2021-01-13 1542 if (val >= SG_MAX_QUEUE) 7323ad3618b61514 Douglas Gilbert 2021-01-13 1543 break; 7323ad3618b61514 Douglas Gilbert 2021-01-13 1544 if (xa_get_mark(&sfp->srp_arr, idx, SG_XA_RQ_INACTIVE)) 7323ad3618b61514 Douglas Gilbert 2021-01-13 1545 continue; 7323ad3618b61514 Douglas Gilbert 2021-01-13 1546 sg_fill_request_element(sfp, srp, rinfop + val); 7323ad3618b61514 Douglas Gilbert 2021-01-13 1547 val++; 7323ad3618b61514 Douglas Gilbert 2021-01-13 1548 } 7323ad3618b61514 Douglas Gilbert 2021-01-13 1549 xa_for_each(&sfp->srp_arr, idx, srp) { 7323ad3618b61514 Douglas Gilbert 2021-01-13 1550 if (!srp) 94d73d8ae7d08375 Douglas Gilbert 2021-01-13 1551 continue; b6d556343c7bbcc4 Douglas Gilbert 2021-01-13 1552 if (val >= SG_MAX_QUEUE) b6d556343c7bbcc4 Douglas Gilbert 2021-01-13 1553 break; 7323ad3618b61514 Douglas Gilbert 2021-01-13 1554 if (!xa_get_mark(&sfp->srp_arr, idx, SG_XA_RQ_INACTIVE)) 7323ad3618b61514 Douglas Gilbert 2021-01-13 1555 continue; b6d556343c7bbcc4 Douglas Gilbert 2021-01-13 1556 sg_fill_request_element(sfp, srp, rinfop + val); b6d556343c7bbcc4 Douglas Gilbert 2021-01-13 1557 val++; b6d556343c7bbcc4 Douglas Gilbert 2021-01-13 1558 } 59774702b44561f8 Douglas Gilbert 2021-01-13 1559 #ifdef CONFIG_COMPAT 59774702b44561f8 Douglas Gilbert 2021-01-13 1560 if (in_compat_syscall()) b6d556343c7bbcc4 Douglas Gilbert 2021-01-13 1561 result = put_compat_request_table(p, rinfop); 59774702b44561f8 Douglas Gilbert 2021-01-13 1562 else b6d556343c7bbcc4 Douglas Gilbert 2021-01-13 1563 result = copy_to_user(p, rinfop, 59774702b44561f8 Douglas Gilbert 2021-01-13 1564 SZ_SG_REQ_INFO * SG_MAX_QUEUE); 59774702b44561f8 Douglas Gilbert 2021-01-13 1565 #else b6d556343c7bbcc4 Douglas Gilbert 2021-01-13 1566 result = copy_to_user(p, rinfop, 59774702b44561f8 Douglas Gilbert 2021-01-13 1567 SZ_SG_REQ_INFO * SG_MAX_QUEUE); 59774702b44561f8 Douglas Gilbert 2021-01-13 1568 #endif b6d556343c7bbcc4 Douglas Gilbert 2021-01-13 1569 kfree(rinfop); 59774702b44561f8 Douglas Gilbert 2021-01-13 @1570 return result; 59774702b44561f8 Douglas Gilbert 2021-01-13 1571 } 59774702b44561f8 Douglas Gilbert 2021-01-13 1572 :::::: The code at line 1570 was first introduced by commit :::::: 59774702b44561f81e4d99d795916d17c4a20d67 scsi: sg: ioctl() handling :::::: TO: Douglas Gilbert <[email protected]> :::::: CC: Martin K. Petersen <[email protected]> --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/[email protected]
.config.gz
Description: application/gzip
_______________________________________________ kbuild mailing list -- [email protected] To unsubscribe send an email to [email protected]
