8:04 a.m.
Hi Hoang,
FYI, the error/warning still remains.
tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
linux-4.9.y
head: b76c99cf586bd7e2078de72e6ca5195be58b0dbf
commit: 310014f572a59b311c175321265a08c9adfced0c [1640/2200] tipc: fix NULL deref in
tipc_link_xmit()
config: powerpc64-randconfig-r033-20210412 (attached as .config)
compiler: clang version 13.0.0 (https://github.com/llvm/llvm-project
9829f5e6b1bca9b61efc629770d28bb9014dec45)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O
~/bin/make.cross
chmod +x ~/bin/make.cross
# install powerpc64 cross compiling tool for clang build
# apt-get install binutils-powerpc64-linux-gnu
#
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gi...
git remote add linux-stable-rc
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git fetch --no-tags linux-stable-rc linux-4.9.y
git checkout 310014f572a59b311c175321265a08c9adfced0c
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=powerpc64
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp(a)intel.com>
All warnings (new ones prefixed by >>):
net/tipc/link.c:299:5: warning: no previous prototype for function
'tipc_link_is_active' [-Wmissing-prototypes]
int tipc_link_is_active(struct tipc_link *l)
^
net/tipc/link.c:299:1: note: declare 'static' if the function is not intended
to be used outside of this translation unit
int tipc_link_is_active(struct tipc_link *l)
^
static
net/tipc/link.c:375:5: warning: no previous prototype for function
'link_bc_rcv_gap' [-Wmissing-prototypes]
u16 link_bc_rcv_gap(struct tipc_link *l)
^
net/tipc/link.c:375:1: note: declare 'static' if the function is not intended
to be used outside of this translation unit
u16 link_bc_rcv_gap(struct tipc_link *l)
^
static
net/tipc/link.c:819:6: warning: no previous prototype for function
'link_prepare_wakeup' [-Wmissing-prototypes]
void link_prepare_wakeup(struct tipc_link *l)
^
net/tipc/link.c:819:1: note: declare 'static' if the function is not intended
to be used outside of this translation unit
void link_prepare_wakeup(struct tipc_link *l)
^
static
> net/tipc/link.c:896:23: warning: variable 'hdr' is
uninitialized when used here [-Wuninitialized]
imp =
msg_importance(hdr);
^~~
net/tipc/link.c:890:22: note: initialize the variable 'hdr' to silence this
warning
struct tipc_msg *hdr;
^
= NULL
net/tipc/link.c:959:6: warning: no previous prototype for function
'tipc_link_advance_backlog' [-Wmissing-prototypes]
void tipc_link_advance_backlog(struct tipc_link *l, struct sk_buff_head *xmitq)
^
net/tipc/link.c:959:1: note: declare 'static' if the function is not intended
to be used outside of this translation unit
void tipc_link_advance_backlog(struct tipc_link *l, struct sk_buff_head *xmitq)
^
static
net/tipc/link.c:1002:5: warning: no previous prototype for function
'tipc_link_retrans' [-Wmissing-prototypes]
int tipc_link_retrans(struct tipc_link *l, u16 from, u16 to,
^
net/tipc/link.c:1002:1: note: declare 'static' if the function is not intended
to be used outside of this translation unit
int tipc_link_retrans(struct tipc_link *l, u16 from, u16 to,
^
static
6 warnings generated.
vim +/hdr +896 net/tipc/link.c
865
866 /**
867 * tipc_link_xmit(): enqueue buffer list according to queue situation
868 * @link: link to use
869 * @list: chain of buffers containing message
870 * @xmitq: returned list of packets to be sent by caller
871 *
872 * Consumes the buffer chain, except when returning -ELINKCONG,
873 * since the caller then may want to make more send attempts.
874 * Returns 0 if success, or errno: -ELINKCONG, -EMSGSIZE or -ENOBUFS
875 * Messages at TIPC_SYSTEM_IMPORTANCE are always accepted
876 */
877 int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
878 struct sk_buff_head *xmitq)
879 {
880 unsigned int maxwin = l->window;
881 unsigned int i;
882 unsigned int mtu = l->mtu;
883 u16 ack = l->rcv_nxt - 1;
884 u16 seqno = l->snd_nxt;
885 u16 bc_ack = l->bc_rcvlink->rcv_nxt - 1;
886 struct sk_buff_head *transmq = &l->transmq;
887 struct sk_buff_head *backlogq = &l->backlogq;
888 struct sk_buff *skb, *_skb, *bskb;
889 int pkt_cnt = skb_queue_len(list);
890 struct tipc_msg *hdr;
891 int imp;
892
893 if (pkt_cnt <= 0)
894 return 0;
895
896 imp = msg_importance(hdr);
897 /* Match msg importance
against this and all higher backlog limits: */
898 if (!skb_queue_empty(backlogq)) {
899 for (i = imp; i <= TIPC_SYSTEM_IMPORTANCE; i++) {
900 if (unlikely(l->backlog[i].len >= l->backlog[i].limit))
901 return link_schedule_user(l, list);
902 }
903 }
904
905 hdr = buf_msg(skb_peek(list));
906 if (unlikely(msg_size(hdr) > mtu)) {
907 skb_queue_purge(list);
908 return -EMSGSIZE;
909 }
910
911 if (pkt_cnt > 1) {
912 l->stats.sent_fragmented++;
913 l->stats.sent_fragments += pkt_cnt;
914 }
915
916 /* Prepare each packet for sending, and add to relevant queue: */
917 while (skb_queue_len(list)) {
918 skb = skb_peek(list);
919 hdr = buf_msg(skb);
920 msg_set_seqno(hdr, seqno);
921 msg_set_ack(hdr, ack);
922 msg_set_bcast_ack(hdr, bc_ack);
923
924 if (likely(skb_queue_len(transmq) < maxwin)) {
925 _skb = skb_clone(skb, GFP_ATOMIC);
926 if (!_skb) {
927 skb_queue_purge(list);
928 return -ENOBUFS;
929 }
930 __skb_dequeue(list);
931 __skb_queue_tail(transmq, skb);
932 __skb_queue_tail(xmitq, _skb);
933 TIPC_SKB_CB(skb)->ackers = l->ackers;
934 l->rcv_unacked = 0;
935 l->stats.sent_pkts++;
936 seqno++;
937 continue;
938 }
939 if (tipc_msg_bundle(skb_peek_tail(backlogq), hdr, mtu)) {
940 kfree_skb(__skb_dequeue(list));
941 l->stats.sent_bundled++;
942 continue;
943 }
944 if (tipc_msg_make_bundle(&bskb, hdr, mtu, l->addr)) {
945 kfree_skb(__skb_dequeue(list));
946 __skb_queue_tail(backlogq, bskb);
947 l->backlog[msg_importance(buf_msg(bskb))].len++;
948 l->stats.sent_bundled++;
949 l->stats.sent_bundles++;
950 continue;
951 }
952 l->backlog[imp].len += skb_queue_len(list);
953 skb_queue_splice_tail_init(list, backlogq);
954 }
955 l->snd_nxt = seqno;
956 return 0;
957 }
958
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org