tree: https://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux.git 20200610-blktrace-fixes head: aa41a0894720cfcfb69370048c2592ec065f67f3 commit: e31a472183cefa50dfb63cb0495b0bd0996d9beb [8/9] blktrace: fix debugfs use after free config: arm64-randconfig-r032-20200611 (attached as .config) compiler: clang version 11.0.0 (https://github.com/llvm/llvm-project bc2b70982be8f5250cd0082a7190f8b417bd4dfe) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # install arm64 cross compiling tool for clang build # apt-get install binutils-aarch64-linux-gnu git checkout e31a472183cefa50dfb63cb0495b0bd0996d9beb # save the attached .config to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm64 If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp(a)intel.com&gt; All errors (new ones prefixed by >>, old ones prefixed by <<): dir = q->debugfs_dir; ~ ^ kernel/trace/blktrace.c:788:5: warning: no previous prototype for function 'blk_trace_bio_get_cgid' [-Wmissing-prototypes] u64 blk_trace_bio_get_cgid(struct request_queue *q, struct bio *bio) ^ kernel/trace/blktrace.c:788:1: note: declare 'static' if the function is not intended to be used outside of this translation unit u64 blk_trace_bio_get_cgid(struct request_queue *q, struct bio *bio) ^ static 1 warning and 1 error generated. vim +535 kernel/trace/blktrace.c 474 475 /* 476 * Setup everything required to start tracing 477 */ 478 static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, 479 struct block_device *bdev, 480 struct blk_user_trace_setup *buts) 481 { 482 struct blk_trace *bt = NULL; 483 struct dentry *dir = NULL; 484 int ret; 485 486 lockdep_assert_held(&q->blk_trace_mutex); 487 488 if (!buts->buf_size || !buts->buf_nr) 489 return -EINVAL; 490 491 if (!blk_debugfs_root) 492 return -ENOENT; 493 494 strncpy(buts->name, name, BLKTRACE_BDEV_SIZE); 495 buts->name[BLKTRACE_BDEV_SIZE - 1] = '\0'; 496 497 /* 498 * some device names have larger paths - convert the slashes 499 * to underscores for this to work as expected 500 */ 501 strreplace(buts->name, '/', '_'); 502 503 /* 504 * bdev can be NULL, as with scsi-generic, this is as helpful as 505 * we can be. 506 */ 507 if (rcu_dereference_protected(q->blk_trace, 508 lockdep_is_held(&q->blk_trace_mutex))) { 509 pr_warn("Concurrent blktraces are not allowed on %s\n", 510 buts->name); 511 return -EBUSY; 512 } 513 514 bt = kzalloc(sizeof(*bt), GFP_KERNEL); 515 if (!bt) 516 return -ENOMEM; 517 518 ret = -ENOMEM; 519 bt->sequence = alloc_percpu(unsigned long); 520 if (!bt->sequence) 521 goto err; 522 523 bt->msg_data = __alloc_percpu(BLK_TN_MAX_MSG, __alignof__(char)); 524 if (!bt->msg_data) 525 goto err; 526 527 /* 528 * When tracing whole make_request drivers (multiqueue) block devices, 529 * reuse the existing debugfs directory created by the block layer on 530 * init. For request-based block devices, all partitions block devices, 531 * and scsi-generic block devices we create a temporary new debugfs 532 * directory that will be removed once the trace ends. 533 */ 534 if (queue_is_mq(q) && bdev && bdev == bdev->bd_contains) 536 else 537 bt->dir = dir = debugfs_create_dir(buts->name, blk_debugfs_root); 538 539 bt->dev = dev; 540 atomic_set(&bt->dropped, 0); 541 INIT_LIST_HEAD(&bt->running_list); 542 543 ret = -EIO; 544 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt, 545 &blk_dropped_fops); 546 547 bt->msg_file = debugfs_create_file("msg", 0222, dir, bt, &blk_msg_fops); 548 549 bt->rchan = relay_open("trace", dir, buts->buf_size, 550 buts->buf_nr, &blk_relay_callbacks, bt); 551 if (!bt->rchan) 552 goto err; 553 554 bt->act_mask = buts->act_mask; 555 if (!bt->act_mask) 556 bt->act_mask = (u16) -1; 557 558 blk_trace_setup_lba(bt, bdev); 559 560 /* overwrite with user settings */ 561 if (buts->start_lba) 562 bt->start_lba = buts->start_lba; 563 if (buts->end_lba) 564 bt->end_lba = buts->end_lba; 565 566 bt->pid = buts->pid; 567 bt->trace_state = Blktrace_setup; 568 569 rcu_assign_pointer(q->blk_trace, bt); 570 get_probe_ref(); 571 572 ret = 0; 573 err: 574 if (ret) 575 blk_trace_free(bt); 576 return ret; 577 } 578 --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org