tree: https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git wip/jgg-for-next head: c88b31c46cefe50f524a1ad3deaf1599bc9ee2e6 commit: f0751419d3a15fb06d9b7d9435312472c3cb122d [198/203] RDMA/rtrs: Only allow addition of path to an already established session config: ia64-randconfig-m031-20210209 (attached as .config) compiler: ia64-linux-gcc (GCC) 9.3.0 If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp(a)intel.com&gt; Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com&gt; smatch warnings: drivers/infiniband/ulp/rtrs/rtrs-srv.c:1805 rtrs_rdma_connect() warn: passing zero to 'PTR_ERR' vim +/PTR_ERR +1805 drivers/infiniband/ulp/rtrs/rtrs-srv.c 9cb837480424e7 Jack Wang 2020-05-11 1760 static int rtrs_rdma_connect(struct rdma_cm_id *cm_id, 9cb837480424e7 Jack Wang 2020-05-11 1761 const struct rtrs_msg_conn_req *msg, 9cb837480424e7 Jack Wang 2020-05-11 1762 size_t len) 9cb837480424e7 Jack Wang 2020-05-11 1763 { 9cb837480424e7 Jack Wang 2020-05-11 1764 struct rtrs_srv_ctx *ctx = cm_id->context; 9cb837480424e7 Jack Wang 2020-05-11 1765 struct rtrs_srv_sess *sess; 9cb837480424e7 Jack Wang 2020-05-11 1766 struct rtrs_srv *srv; 9cb837480424e7 Jack Wang 2020-05-11 1767 9cb837480424e7 Jack Wang 2020-05-11 1768 u16 version, con_num, cid; 9cb837480424e7 Jack Wang 2020-05-11 1769 u16 recon_cnt; 9cb837480424e7 Jack Wang 2020-05-11 1770 int err; 9cb837480424e7 Jack Wang 2020-05-11 1771 9cb837480424e7 Jack Wang 2020-05-11 1772 if (len < sizeof(*msg)) { 9cb837480424e7 Jack Wang 2020-05-11 1773 pr_err("Invalid RTRS connection request\n"); 9cb837480424e7 Jack Wang 2020-05-11 1774 goto reject_w_econnreset; 9cb837480424e7 Jack Wang 2020-05-11 1775 } 9cb837480424e7 Jack Wang 2020-05-11 1776 if (le16_to_cpu(msg->magic) != RTRS_MAGIC) { 9cb837480424e7 Jack Wang 2020-05-11 1777 pr_err("Invalid RTRS magic\n"); 9cb837480424e7 Jack Wang 2020-05-11 1778 goto reject_w_econnreset; 9cb837480424e7 Jack Wang 2020-05-11 1779 } 9cb837480424e7 Jack Wang 2020-05-11 1780 version = le16_to_cpu(msg->version); 9cb837480424e7 Jack Wang 2020-05-11 1781 if (version >> 8 != RTRS_PROTO_VER_MAJOR) { 9cb837480424e7 Jack Wang 2020-05-11 1782 pr_err("Unsupported major RTRS version: %d, expected %d\n", 9cb837480424e7 Jack Wang 2020-05-11 1783 version >> 8, RTRS_PROTO_VER_MAJOR); 9cb837480424e7 Jack Wang 2020-05-11 1784 goto reject_w_econnreset; 9cb837480424e7 Jack Wang 2020-05-11 1785 } 9cb837480424e7 Jack Wang 2020-05-11 1786 con_num = le16_to_cpu(msg->cid_num); 9cb837480424e7 Jack Wang 2020-05-11 1787 if (con_num > 4096) { 9cb837480424e7 Jack Wang 2020-05-11 1788 /* Sanity check */ 9cb837480424e7 Jack Wang 2020-05-11 1789 pr_err("Too many connections requested: %d\n", con_num); 9cb837480424e7 Jack Wang 2020-05-11 1790 goto reject_w_econnreset; 9cb837480424e7 Jack Wang 2020-05-11 1791 } 9cb837480424e7 Jack Wang 2020-05-11 1792 cid = le16_to_cpu(msg->cid); 9cb837480424e7 Jack Wang 2020-05-11 1793 if (cid >= con_num) { 9cb837480424e7 Jack Wang 2020-05-11 1794 /* Sanity check */ 9cb837480424e7 Jack Wang 2020-05-11 1795 pr_err("Incorrect cid: %d >= %d\n", cid, con_num); 9cb837480424e7 Jack Wang 2020-05-11 1796 goto reject_w_econnreset; 9cb837480424e7 Jack Wang 2020-05-11 1797 } 9cb837480424e7 Jack Wang 2020-05-11 1798 recon_cnt = le16_to_cpu(msg->recon_cnt); f0751419d3a15f Md Haris Iqbal 2021-02-12 1799 srv = get_or_create_srv(ctx, &msg->paths_uuid, msg->first_conn); d715ff8acbd587 Guoqing Jiang 2020-10-23 1800 /* d715ff8acbd587 Guoqing Jiang 2020-10-23 1801 * "refcount == 0" happens if a previous thread calls get_or_create_srv d715ff8acbd587 Guoqing Jiang 2020-10-23 1802 * allocate srv, but chunks of srv are not allocated yet. d715ff8acbd587 Guoqing Jiang 2020-10-23 1803 */ f0751419d3a15f Md Haris Iqbal 2021-02-12 1804 if (IS_ERR(srv) || refcount_read(&srv->refcount) == 0) { f0751419d3a15f Md Haris Iqbal 2021-02-12 @1805 err = PTR_ERR(srv); It's not 100% clear to me that an error code is required when refcount_read() is zero. Maybe "err = 0;" is okay in that situation? 9cb837480424e7 Jack Wang 2020-05-11 1806 goto reject_w_err; 9cb837480424e7 Jack Wang 2020-05-11 1807 } 9cb837480424e7 Jack Wang 2020-05-11 1808 mutex_lock(&srv->paths_mutex); 9cb837480424e7 Jack Wang 2020-05-11 1809 sess = __find_sess(srv, &msg->sess_uuid); 9cb837480424e7 Jack Wang 2020-05-11 1810 if (sess) { 9cb837480424e7 Jack Wang 2020-05-11 1811 struct rtrs_sess *s = &sess->s; 9cb837480424e7 Jack Wang 2020-05-11 1812 9cb837480424e7 Jack Wang 2020-05-11 1813 /* Session already holds a reference */ 9cb837480424e7 Jack Wang 2020-05-11 1814 put_srv(srv); 9cb837480424e7 Jack Wang 2020-05-11 1815 9cb837480424e7 Jack Wang 2020-05-11 1816 if (sess->state != RTRS_SRV_CONNECTING) { 9cb837480424e7 Jack Wang 2020-05-11 1817 rtrs_err(s, "Session in wrong state: %s\n", 9cb837480424e7 Jack Wang 2020-05-11 1818 rtrs_srv_state_str(sess->state)); 9cb837480424e7 Jack Wang 2020-05-11 1819 mutex_unlock(&srv->paths_mutex); 9cb837480424e7 Jack Wang 2020-05-11 1820 goto reject_w_econnreset; 9cb837480424e7 Jack Wang 2020-05-11 1821 } 9cb837480424e7 Jack Wang 2020-05-11 1822 /* 9cb837480424e7 Jack Wang 2020-05-11 1823 * Sanity checks 9cb837480424e7 Jack Wang 2020-05-11 1824 */ e172037be757dc Md Haris Iqbal 2020-05-22 1825 if (con_num != s->con_num || cid >= s->con_num) { 9cb837480424e7 Jack Wang 2020-05-11 1826 rtrs_err(s, "Incorrect request: %d, %d\n", 9cb837480424e7 Jack Wang 2020-05-11 1827 cid, con_num); 9cb837480424e7 Jack Wang 2020-05-11 1828 mutex_unlock(&srv->paths_mutex); 9cb837480424e7 Jack Wang 2020-05-11 1829 goto reject_w_econnreset; 9cb837480424e7 Jack Wang 2020-05-11 1830 } e172037be757dc Md Haris Iqbal 2020-05-22 1831 if (s->con[cid]) { 9cb837480424e7 Jack Wang 2020-05-11 1832 rtrs_err(s, "Connection already exists: %d\n", 9cb837480424e7 Jack Wang 2020-05-11 1833 cid); 9cb837480424e7 Jack Wang 2020-05-11 1834 mutex_unlock(&srv->paths_mutex); 9cb837480424e7 Jack Wang 2020-05-11 1835 goto reject_w_econnreset; 9cb837480424e7 Jack Wang 2020-05-11 1836 } 9cb837480424e7 Jack Wang 2020-05-11 1837 } else { 9cb837480424e7 Jack Wang 2020-05-11 1838 sess = __alloc_sess(srv, cm_id, con_num, recon_cnt, 9cb837480424e7 Jack Wang 2020-05-11 1839 &msg->sess_uuid); 9cb837480424e7 Jack Wang 2020-05-11 1840 if (IS_ERR(sess)) { 9cb837480424e7 Jack Wang 2020-05-11 1841 mutex_unlock(&srv->paths_mutex); 9cb837480424e7 Jack Wang 2020-05-11 1842 put_srv(srv); 9cb837480424e7 Jack Wang 2020-05-11 1843 err = PTR_ERR(sess); 9cb837480424e7 Jack Wang 2020-05-11 1844 goto reject_w_err; 9cb837480424e7 Jack Wang 2020-05-11 1845 } 9cb837480424e7 Jack Wang 2020-05-11 1846 } 9cb837480424e7 Jack Wang 2020-05-11 1847 err = create_con(sess, cm_id, cid); 9cb837480424e7 Jack Wang 2020-05-11 1848 if (err) { 9cb837480424e7 Jack Wang 2020-05-11 1849 (void)rtrs_rdma_do_reject(cm_id, err); 9cb837480424e7 Jack Wang 2020-05-11 1850 /* 9cb837480424e7 Jack Wang 2020-05-11 1851 * Since session has other connections we follow normal way 9cb837480424e7 Jack Wang 2020-05-11 1852 * through workqueue, but still return an error to tell cma.c 9cb837480424e7 Jack Wang 2020-05-11 1853 * to call rdma_destroy_id() for current connection. 9cb837480424e7 Jack Wang 2020-05-11 1854 */ 9cb837480424e7 Jack Wang 2020-05-11 1855 goto close_and_return_err; 9cb837480424e7 Jack Wang 2020-05-11 1856 } 9cb837480424e7 Jack Wang 2020-05-11 1857 err = rtrs_rdma_do_accept(sess, cm_id); 9cb837480424e7 Jack Wang 2020-05-11 1858 if (err) { 9cb837480424e7 Jack Wang 2020-05-11 1859 (void)rtrs_rdma_do_reject(cm_id, err); 9cb837480424e7 Jack Wang 2020-05-11 1860 /* 9cb837480424e7 Jack Wang 2020-05-11 1861 * Since current connection was successfully added to the 9cb837480424e7 Jack Wang 2020-05-11 1862 * session we follow normal way through workqueue to close the 9cb837480424e7 Jack Wang 2020-05-11 1863 * session, thus return 0 to tell cma.c we call 9cb837480424e7 Jack Wang 2020-05-11 1864 * rdma_destroy_id() ourselves. 9cb837480424e7 Jack Wang 2020-05-11 1865 */ 9cb837480424e7 Jack Wang 2020-05-11 1866 err = 0; 9cb837480424e7 Jack Wang 2020-05-11 1867 goto close_and_return_err; 9cb837480424e7 Jack Wang 2020-05-11 1868 } 9cb837480424e7 Jack Wang 2020-05-11 1869 mutex_unlock(&srv->paths_mutex); 9cb837480424e7 Jack Wang 2020-05-11 1870 9cb837480424e7 Jack Wang 2020-05-11 1871 return 0; 9cb837480424e7 Jack Wang 2020-05-11 1872 9cb837480424e7 Jack Wang 2020-05-11 1873 reject_w_err: 9cb837480424e7 Jack Wang 2020-05-11 1874 return rtrs_rdma_do_reject(cm_id, err); 9cb837480424e7 Jack Wang 2020-05-11 1875 9cb837480424e7 Jack Wang 2020-05-11 1876 reject_w_econnreset: 9cb837480424e7 Jack Wang 2020-05-11 1877 return rtrs_rdma_do_reject(cm_id, -ECONNRESET); 9cb837480424e7 Jack Wang 2020-05-11 1878 9cb837480424e7 Jack Wang 2020-05-11 1879 close_and_return_err: 9cb837480424e7 Jack Wang 2020-05-11 1880 mutex_unlock(&srv->paths_mutex); 99f0c380797335 Jack Wang 2020-12-17 1881 close_sess(sess); 9cb837480424e7 Jack Wang 2020-05-11 1882 9cb837480424e7 Jack Wang 2020-05-11 1883 return err; 9cb837480424e7 Jack Wang 2020-05-11 1884 } --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org