Re: [kbuild] [peterz-queue:perf/core 34/45] kernel/events/core.c:4365 perf_mmap_close() error: double unlock 'mutex:event-mmap_mutex'
The locking check sucks. I need to re-write it.
regards,
dan carpenter
On Tue, Feb 03, 2015 at 10:47:55PM +0800, kbuild test robot wrote:
TO: Peter Zijlstra pet...@infradead.org
CC: Alexander Shishkin alexander.shish...@linux.intel.com
tree: git://git.kernel.org/pub/scm/linux/kernel/git/peterz/queue.git
perf/core
head: 7fe898837422b0205343b26d02f747a063a6ccfe
commit: 324f99a6daa03968f9240cccb60bdea89917cd69 [34/45] perf: Add AUX area
to ring buffer for raw data streams
:: branch date: 75 minutes ago
:: commit date: 75 minutes ago
kernel/events/core.c:4365 perf_mmap_close() error: double unlock
'mutex:event-mmap_mutex'
git remote add peterz-queue
git://git.kernel.org/pub/scm/linux/kernel/git/peterz/queue.git
git remote update peterz-queue
git checkout 324f99a6daa03968f9240cccb60bdea89917cd69
vim +4365 kernel/events/core.c
324f99a6 kernel/events/core.c Peter Zijlstra 2015-01-14 4349 */
324f99a6 kernel/events/core.c Peter Zijlstra 2015-01-14 4350 if
(rb_has_aux(rb) vma-vm_pgoff == rb-aux_pgoff
324f99a6 kernel/events/core.c Peter Zijlstra 2015-01-14 4351
atomic_dec_and_mutex_lock(rb-aux_mmap_count, event-mmap_mutex)) {
324f99a6 kernel/events/core.c Peter Zijlstra 2015-01-14 4352
atomic_long_sub(rb-aux_nr_pages, mmap_user-locked_vm);
324f99a6 kernel/events/core.c Peter Zijlstra 2015-01-14 4353
vma-vm_mm-pinned_vm -= rb-aux_mmap_locked;
324f99a6 kernel/events/core.c Peter Zijlstra 2015-01-14 4354
324f99a6 kernel/events/core.c Peter Zijlstra 2015-01-14 4355
rb_free_aux(rb);
324f99a6 kernel/events/core.c Peter Zijlstra 2015-01-14 4356
mutex_unlock(event-mmap_mutex);
324f99a6 kernel/events/core.c Peter Zijlstra 2015-01-14 4357 }
324f99a6 kernel/events/core.c Peter Zijlstra 2015-01-14 4358
9bb5d40c kernel/events/core.c Peter Zijlstra 2013-06-04 4359
atomic_dec(rb-mmap_count);
9bb5d40c kernel/events/core.c Peter Zijlstra 2013-06-04 4360
9bb5d40c kernel/events/core.c Peter Zijlstra 2013-06-04 4361 if
(!atomic_dec_and_mutex_lock(event-mmap_count, event-mmap_mutex))
b69cf536 kernel/events/core.c Peter Zijlstra 2014-03-14 4362
goto out_put;
9bb5d40c kernel/events/core.c Peter Zijlstra 2013-06-04 4363
b69cf536 kernel/events/core.c Peter Zijlstra 2014-03-14 4364
ring_buffer_attach(event, NULL);
cdd6c482 kernel/perf_event.c Ingo Molnar2009-09-21 @4365
mutex_unlock(event-mmap_mutex);
ac9721f3 kernel/perf_event.c Peter Zijlstra 2010-05-27 4366
9bb5d40c kernel/events/core.c Peter Zijlstra 2013-06-04 4367 /* If
there's still other mmap()s of this buffer, we're done. */
b69cf536 kernel/events/core.c Peter Zijlstra 2014-03-14 4368 if
(atomic_read(rb-mmap_count))
b69cf536 kernel/events/core.c Peter Zijlstra 2014-03-14 4369
goto out_put;
9bb5d40c kernel/events/core.c Peter Zijlstra 2013-06-04 4370
9bb5d40c kernel/events/core.c Peter Zijlstra 2013-06-04 4371 /*
9bb5d40c kernel/events/core.c Peter Zijlstra 2013-06-04 4372 * No
other mmap()s, detach from all other events that might redirect
9bb5d40c kernel/events/core.c Peter Zijlstra 2013-06-04 4373 * into
the now unreachable buffer. Somewhat complicated by the
:: The code at line 4365 was first introduced by commit
:: cdd6c482c9ff9c55475ee7392ec8f672eddb7be6 perf: Do the big rename:
Performance Counters - Performance Events
:: TO: Ingo Molnar mi...@elte.hu
:: CC: Ingo Molnar mi...@elte.hu
---
0-DAY kernel test infrastructureOpen Source Technology Center
http://lists.01.org/mailman/listinfo/kbuild Intel Corporation
___
kbuild mailing list
kbuild@lists.01.org
https://lists.01.org/mailman/listinfo/kbuild
[kbuild] [baohua:sirf-devel 0/5] drivers/media/mjpeg/mjpegdev.c:626 jpeg_ioctl() warn: maybe return -EFAULT instead of the bytes remaining?
tree: git://git.kernel.org/pub/scm/linux/kernel/git/baohua/linux sirf-devel
head: cca7598d3c1497c3190eecef53f1972ac83ea2d8
commit: f8593fe3c0c33ce44ff044469d489d76f2ad869a [0/5] media: csr-mjpeg: change
ioctl return value
New smatch warnings:
drivers/media/mjpeg/mjpegdev.c:626 jpeg_ioctl() warn: maybe return -EFAULT
instead of the bytes remaining?
drivers/media/mjpeg/mjpegdev.c:700 jpeg_ioctl() warn: maybe return -EFAULT
instead of the bytes remaining?
Old smatch warnings:
drivers/media/mjpeg/mjpegdev.c:62 jpeg_alloc_buf() error: we previously assumed
'hwbuf' could be null (see line 61)
drivers/media/mjpeg/mjpegdev.c:78 jpeg_alloc_buf() warn: inconsistent returns
'mutex:jpeg.pool_lock'.
Locked on: line 67
Unlocked on: line 78
drivers/media/mjpeg/mjpegdev.c:90 jpeg_free_buf() error: we previously assumed
'hwbuf' could be null (see line 89)
drivers/media/mjpeg/mjpegdev.c:101 jpeg_free_buf() warn: inconsistent returns
'mutex:jpeg.pool_lock'.
Locked on: line 96
Unlocked on: line 101
drivers/media/mjpeg/mjpegdev.c:187 jpeg_wait_interrupt() warn: assigning (-110)
to unsigned variable 'ret'
drivers/media/mjpeg/mjpegdev.c:204 jpeg_wait_interrupt() warn: assigning (-22)
to unsigned variable 'ret'
git remote add baohua git://git.kernel.org/pub/scm/linux/kernel/git/baohua/linux
git remote update baohua
git checkout f8593fe3c0c33ce44ff044469d489d76f2ad869a
vim +626 drivers/media/mjpeg/mjpegdev.c
f8593fe3 Lily.Li 2015-02-04 620if (NULL == phwbuf)
f8593fe3 Lily.Li 2015-02-04 621return -ENOMEM;
f8593fe3 Lily.Li 2015-02-04 622ret = copy_from_user(phwbuf,
(void __user *)arg,
f8593fe3 Lily.Li 2015-02-04 623sizeof(*phwbuf));
f8593fe3 Lily.Li 2015-02-04 624if (ret) {
f8593fe3 Lily.Li 2015-02-04 625kfree(phwbuf);
f8593fe3 Lily.Li 2015-02-04 @626return ret;
db39 Lily.Li 2015-01-09 627}
db39 Lily.Li 2015-01-09 628dbg_msg(1, getbuffer copy size
%lx from user,
db39 Lily.Li 2015-01-09 629 phwbuf-size);
db39 Lily.Li 2015-01-09 630jpeg_alloc_buf(phwbuf-size,
buf_info);
db39 Lily.Li 2015-01-09 631phwbuf-vaddr = buf_info.vaddr;
db39 Lily.Li 2015-01-09 632phwbuf-paddr = buf_info.paddr;
db39 Lily.Li 2015-01-09 633phwbuf-size = buf_info.size;
db39 Lily.Li 2015-01-09 634phwbuf-real_size =
buf_info.real_size;
f8593fe3 Lily.Li 2015-02-04 635ret = copy_to_user((void __user
*)arg, phwbuf,
f8593fe3 Lily.Li 2015-02-04 636sizeof(*phwbuf));
db39 Lily.Li 2015-01-09 637kfree(phwbuf);
db39 Lily.Li 2015-01-09 638break;
db39 Lily.Li 2015-01-09 639}
db39 Lily.Li 2015-01-09 640case IOCTL_JPEG_FREEBUFFER: {
db39 Lily.Li 2015-01-09 641struct jpg_hw_buf *phwbuf;
db39 Lily.Li 2015-01-09 642
db39 Lily.Li 2015-01-09 643dbg_msg(1,
(IOCTL_JPEG_FREEBUFFER\r\n));
db39 Lily.Li 2015-01-09 644phwbuf =
kzalloc(sizeof(*phwbuf), GFP_KERNEL);
f8593fe3 Lily.Li 2015-02-04 645if (NULL == phwbuf)
f8593fe3 Lily.Li 2015-02-04 646return -ENOMEM;
f8593fe3 Lily.Li 2015-02-04 647ret = copy_from_user(phwbuf,
(void __user *)arg,
f8593fe3 Lily.Li 2015-02-04 648sizeof(*phwbuf));
db39 Lily.Li 2015-01-09 649jpeg_free_buf(phwbuf);
db39 Lily.Li 2015-01-09 650/*unmap the viradd in user
mode. */
db39 Lily.Li 2015-01-09 651break;
db39 Lily.Li 2015-01-09 652}
db39 Lily.Li 2015-01-09 653case IOCTL_JPEG_GO: {
db39 Lily.Li 2015-01-09 654dbg_msg(1,
(IOCTL_JPEG_GO\r\n));
f8593fe3 Lily.Li 2015-02-04 655ret =
copy_from_user(codec_param, (void __user *)arg,
f8593fe3 Lily.Li 2015-02-04 656sizeof(codec_param));
f8593fe3 Lily.Li 2015-02-04 657if (ret)
f8593fe3 Lily.Li 2015-02-04 658break;
db39 Lily.Li 2015-01-09 659jpeg_go(codec_param);
db39 Lily.Li 2015-01-09 660break;
db39 Lily.Li 2015-01-09 661}
db39 Lily.Li 2015-01-09 662case IOCTL_JPEG_WAIT: {
db39 Lily.Li 2015-01-09 663dbg_msg(1,
(IOCTL_JPEG_WAIT\r\n));
f8593fe3 Lily.Li 2015-02-04 664ret =
copy_from_user(codec_param, (void __user *)arg,
f8593fe3 Lily.Li 2015-02-04 665sizeof(codec_param));
f8593fe3 Lily.Li 2015-02-04 666if (ret)
f8593fe3 Lily.Li 2015-02-04 667break;
db39 Lily.Li 2015-01-09 668dbg_msg(1, JPEG: -- JPEG_WAIT
--\r\n);
f8593fe3
Re: [kbuild] [nfc-next:master 6/17] net/nfc/nci/hci.c:254 nci_hci_cmd_received() warn: assigning (-128) to unsigned variable 'status'
The warning is correct-ish but the code is ok.
regards,
dan carpenter
On Wed, Feb 04, 2015 at 05:20:27PM +0800, kbuild test robot wrote:
TO: Christophe Ricard christophe.ric...@gmail.com
CC: Samuel Ortiz sa...@linux.intel.com
tree: git://git.kernel.org/pub/scm/linux/kernel/git/sameo/nfc-next.git
master
head: fa00e8fed457841cb24219dbe3cfba7d56de6317
commit: 11f54f228643d0248ec00ce8c9fb8d872f87e7b8 [6/17] NFC: nci: Add HCI
over NCI protocol support
:: branch date: 65 minutes ago
:: commit date: 2 days ago
net/nfc/nci/hci.c:254 nci_hci_cmd_received() warn: assigning (-128) to
unsigned variable 'status'
git remote add nfc-next
git://git.kernel.org/pub/scm/linux/kernel/git/sameo/nfc-next.git
git remote update nfc-next
git checkout 11f54f228643d0248ec00ce8c9fb8d872f87e7b8
vim +/status +254 net/nfc/nci/hci.c
11f54f22 Christophe Ricard 2015-02-01 238
11f54f22 Christophe Ricard 2015-02-01 239return r;
11f54f22 Christophe Ricard 2015-02-01 240 }
11f54f22 Christophe Ricard 2015-02-01 241 EXPORT_SYMBOL(nci_hci_send_cmd);
11f54f22 Christophe Ricard 2015-02-01 242
11f54f22 Christophe Ricard 2015-02-01 243 static void
nci_hci_event_received(struct nci_dev *ndev, u8 pipe,
11f54f22 Christophe Ricard 2015-02-01 244 u8
event, struct sk_buff *skb)
11f54f22 Christophe Ricard 2015-02-01 245 {
11f54f22 Christophe Ricard 2015-02-01 246if
(ndev-ops-hci_event_received)
11f54f22 Christophe Ricard 2015-02-01 247
ndev-ops-hci_event_received(ndev, pipe, event, skb);
11f54f22 Christophe Ricard 2015-02-01 248 }
11f54f22 Christophe Ricard 2015-02-01 249
11f54f22 Christophe Ricard 2015-02-01 250 static void
nci_hci_cmd_received(struct nci_dev *ndev, u8 pipe,
11f54f22 Christophe Ricard 2015-02-01 251 u8
cmd, struct sk_buff *skb)
11f54f22 Christophe Ricard 2015-02-01 252 {
11f54f22 Christophe Ricard 2015-02-01 253u8 gate =
ndev-hci_dev-pipes[pipe].gate;
11f54f22 Christophe Ricard 2015-02-01 @254u8 status = NCI_HCI_ANY_OK |
~NCI_HCI_FRAGMENT;
11f54f22 Christophe Ricard 2015-02-01 255u8 dest_gate, new_pipe;
11f54f22 Christophe Ricard 2015-02-01 256struct nci_hci_create_pipe_resp
*create_info;
11f54f22 Christophe Ricard 2015-02-01 257struct nci_hci_delete_pipe_noti
*delete_info;
11f54f22 Christophe Ricard 2015-02-01 258struct
nci_hci_all_pipe_cleared_noti *cleared_info;
11f54f22 Christophe Ricard 2015-02-01 259
11f54f22 Christophe Ricard 2015-02-01 260pr_debug(from gate %x pipe %x
cmd %x\n, gate, pipe, cmd);
11f54f22 Christophe Ricard 2015-02-01 261
11f54f22 Christophe Ricard 2015-02-01 262switch (cmd) {
---
0-DAY kernel test infrastructureOpen Source Technology Center
http://lists.01.org/mailman/listinfo/kbuild Intel Corporation
___
kbuild mailing list
kbuild@lists.01.org
https://lists.01.org/mailman/listinfo/kbuild
Re: [kbuild] [target:for-next 19/19] drivers/vhost/scsi.c:2139 vhost_scsi_make_tpg() warn: impossible condition '(tpgt (~0)) = (0-u32max u32max)'
I sent a fix for this because it is a memory corruption bug and I am
too selfish to share author credit on those.
regards,
dan carpenter
On Tue, Feb 03, 2015 at 03:20:25PM +0800, kbuild test robot wrote:
TO: Nicholas Bellinger n...@linux-iscsi.org
tree: git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending.git
for-next
head: 2440cd3b0d21c3163d8e473b35d207e16be04595
commit: 2440cd3b0d21c3163d8e473b35d207e16be04595 [19/19] vhost/scsi: Global
tcm_vhost - vhost_scsi rename
:: branch date: 47 minutes ago
:: commit date: 47 minutes ago
New smatch warnings:
drivers/vhost/scsi.c:2139 vhost_scsi_make_tpg() warn: impossible condition
'(tpgt (~0)) = (0-u32max u32max)'
Old smatch warnings:
drivers/vhost/scsi.c:971 vhost_scsi_send_bad_target() warn: check that
'rsp.status' doesn't leak information
git remote add target
git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending.git
git remote update target
git checkout 2440cd3b0d21c3163d8e473b35d207e16be04595
vim +2139 drivers/vhost/scsi.c
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2123 };
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2124
683bd967 drivers/vhost/scsi.c Asias He 2013-05-06 2125
static struct se_portal_group *
2440cd3b drivers/vhost/scsi.c Nicholas Bellinger 2015-01-31 2126
vhost_scsi_make_tpg(struct se_wwn *wwn,
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2127
struct config_group *group,
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2128
const char *name)
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2129 {
2440cd3b drivers/vhost/scsi.c Nicholas Bellinger 2015-01-31 2130
struct vhost_scsi_tport *tport = container_of(wwn,
2440cd3b drivers/vhost/scsi.c Nicholas Bellinger 2015-01-31 2131
struct vhost_scsi_tport, tport_wwn);
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2132
2440cd3b drivers/vhost/scsi.c Nicholas Bellinger 2015-01-31 2133
struct vhost_scsi_tpg *tpg;
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2134
unsigned long tpgt;
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2135
int ret;
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2136
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2137
if (strstr(name, tpgt_) != name)
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2138
return ERR_PTR(-EINVAL);
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 @2139
if (kstrtoul(name + 5, 10, tpgt) || tpgt UINT_MAX)
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2140
return ERR_PTR(-EINVAL);
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2141
2440cd3b drivers/vhost/scsi.c Nicholas Bellinger 2015-01-31 2142
tpg = kzalloc(sizeof(struct vhost_scsi_tpg), GFP_KERNEL);
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2143
if (!tpg) {
2440cd3b drivers/vhost/scsi.c Nicholas Bellinger 2015-01-31 2144
pr_err(Unable to allocate struct vhost_scsi_tpg);
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2145
return ERR_PTR(-ENOMEM);
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2146
}
057cbf49 drivers/vhost/tcm_vhost.c Nicholas Bellinger 2012-07-18 2147
mutex_init(tpg-tv_tpg_mutex);
:: The code at line 2139 was first introduced by commit
:: 057cbf49a1f08297877e46c82f707b1bfea806a8 tcm_vhost: Initial merge for
vhost level target fabric driver
:: TO: Nicholas Bellinger n...@linux-iscsi.org
:: CC: Nicholas Bellinger n...@linux-iscsi.org
---
0-DAY kernel test infrastructureOpen Source Technology Center
http://lists.01.org/mailman/listinfo/kbuild Intel Corporation
___
kbuild mailing list
kbuild@lists.01.org
https://lists.01.org/mailman/listinfo/kbuild
[kbuild] [vfs:iov_iter-net 1213/1225] net/netfilter/nft_hash.c:161 nft_hash_walk() error: 'he' dereferencing possible ERR_PTR()
tree: git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git iov_iter-net
head: fba146979ea7624f59fdfc7745cbcc5d309acabf
commit: 9a7766288274ef765245ed65e6176a2727b96706 [1213/1225] netfilter: Use
rhashtable walk iterator
net/netfilter/nft_hash.c:161 nft_hash_walk() error: 'he' dereferencing possible
ERR_PTR()
git remote add vfs git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git
git remote update vfs
git checkout 9a7766288274ef765245ed65e6176a2727b96706
vim +/he +161 net/netfilter/nft_hash.c
9a776628 Herbert Xu 2015-02-04 145iter-err = err;
9a776628 Herbert Xu 2015-02-04 146goto out;
9a776628 Herbert Xu 2015-02-04 147}
9a776628 Herbert Xu 2015-02-04 148
9a776628 Herbert Xu 2015-02-04 149while ((he =
rhashtable_walk_next(hti))) {
9a776628 Herbert Xu 2015-02-04 150if (IS_ERR(he)) {
9a776628 Herbert Xu 2015-02-04 151err =
PTR_ERR(he);
9a776628 Herbert Xu 2015-02-04 152if (err !=
-EAGAIN) {
9a776628 Herbert Xu 2015-02-04 153
iter-err = err;
9a776628 Herbert Xu 2015-02-04 154goto
out;
9a776628 Herbert Xu 2015-02-04 155}
Smatch is complaining that we are dereference -EAGAIN.
9a776628 Herbert Xu 2015-02-04 156}
88d6ed15 Thomas Graf 2015-01-02 157
20a69341 Patrick McHardy 2013-10-11 158if (iter-count
iter-skip)
20a69341 Patrick McHardy 2013-10-11 159goto cont;
Possibly -EAGAIN means we hit this condition, but I am too lazy to look
up the full context. Plus, it looks like a thinko.
20a69341 Patrick McHardy 2013-10-11 160
20a69341 Patrick McHardy 2013-10-11 @161memcpy(elem.key,
he-key, sizeof(elem.key));
20a69341 Patrick McHardy 2013-10-11 162if (set-flags
NFT_SET_MAP)
20a69341 Patrick McHardy 2013-10-11 163
memcpy(elem.data, he-data, sizeof(elem.data));
20a69341 Patrick McHardy 2013-10-11 164elem.flags = 0;
20a69341 Patrick McHardy 2013-10-11 165
20a69341 Patrick McHardy 2013-10-11 166iter-err =
iter-fn(ctx, set, iter, elem);
20a69341 Patrick McHardy 2013-10-11 167if (iter-err 0)
9a776628 Herbert Xu 2015-02-04 168goto out;
9a776628 Herbert Xu 2015-02-04 169
---
0-DAY kernel test infrastructureOpen Source Technology Center
http://lists.01.org/mailman/listinfo/kbuild Intel Corporation
___
kbuild mailing list
kbuild@lists.01.org
https://lists.01.org/mailman/listinfo/kbuild
