[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <5d48dd9a-1822-4917-a77e-193a48ed3bd8@kili.mountain>
Date: Fri, 19 May 2023 19:14:10 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Chuck Lever III <chuck.lever@...cle.com>
Cc: Naresh Kamboju <naresh.kamboju@...aro.org>,
Linux-Next Mailing List <linux-next@...r.kernel.org>,
open list <linux-kernel@...r.kernel.org>,
linux-fsdevel <linux-fsdevel@...r.kernel.org>,
linux-mm <linux-mm@...ck.org>,
"lkft-triage@...ts.linaro.org" <lkft-triage@...ts.linaro.org>,
Al Viro <viro@...iv.linux.org.uk>,
Christian Brauner <brauner@...nel.org>,
"Paul E. McKenney" <paulmck@...nel.org>,
"frederic@...nel.org" <frederic@...nel.org>,
Arnd Bergmann <arnd@...db.de>,
Anders Roxell <anders.roxell@...aro.org>,
Jakub Kacinski <kuba@...nel.org>,
"David S. Miller" <davem@...emloft.net>,
Netdev <netdev@...r.kernel.org>
Subject: Re: next: qemu-arm64: kernel BUG at fs/inode.c:1763!
Btw, Smatch doesn't like that file at all...
sock->file = sock_alloc_file(sock, O_NONBLOCK, NULL);
^^^^ ^^^^
sock_alloc_file() calls release_sock() on error but the left hand
side of the assignment dereferences "sock". This isn't the bug and I
didn't report this earlier because there is an assert that it doesn't
fail.
net/handshake/handshake-test.c:221 handshake_req_submit_test4() error: dereferencing freed memory 'sock'
net/handshake/handshake-test.c:233 handshake_req_submit_test4() warn: 'req' was already freed.
net/handshake/handshake-test.c:254 handshake_req_submit_test5() error: dereferencing freed memory 'sock'
net/handshake/handshake-test.c:290 handshake_req_submit_test6() error: dereferencing freed memory 'sock'
net/handshake/handshake-test.c:321 handshake_req_cancel_test1() error: dereferencing freed memory 'sock'
net/handshake/handshake-test.c:355 handshake_req_cancel_test2() error: dereferencing freed memory 'sock'
net/handshake/handshake-test.c:367 handshake_req_cancel_test2() warn: 'req' was already freed.
net/handshake/handshake-test.c:395 handshake_req_cancel_test3() error: dereferencing freed memory 'sock'
net/handshake/handshake-test.c:407 handshake_req_cancel_test3() warn: 'req' was already freed.
net/handshake/handshake-test.c:451 handshake_req_destroy_test1() error: dereferencing freed memory 'sock'
net/handshake/handshake-test.c:463 handshake_req_destroy_test1() warn: 'req' was already freed.
regards,
dan carpenter
Powered by blists - more mailing lists