linux-kernel - drivers/block/rnbd/rnbd-clt.c:1429 init_dev() warn: unsigned 'dev->clt_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <202512240645.rx8BjT1r-lkp@intel.com>
Date: Wed, 24 Dec 2025 06:33:54 +0800
From: kernel test robot <lkp@...el.com>
To: Thomas Fourier <fourier.thomas@...il.com>
Cc: oe-kbuild-all@...ts.linux.dev, linux-kernel@...r.kernel.org,
 Jens Axboe <axboe@...nel.dk>
Subject: drivers/block/rnbd/rnbd-clt.c:1429 init_dev() warn: unsigned
 'dev->clt_device_id' is never less than zero.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   b927546677c876e26eba308550207c2ddf812a43
commit: c9b5645fd8ca10f310e41b07540f98e6a9720f40 block: rnbd-clt: Fix leaked ID in init_dev()
date:   5 days ago
config: csky-randconfig-r072-20251224 (https://download.01.org/0day-ci/archive/20251224/202512240645.rx8BjT1r-lkp@intel.com/config)
compiler: csky-linux-gcc (GCC) 15.1.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202512240645.rx8BjT1r-lkp@intel.com/

New smatch warnings:
drivers/block/rnbd/rnbd-clt.c:1429 init_dev() warn: unsigned 'dev->clt_device_id' is never less than zero.

Old smatch warnings:
drivers/block/rnbd/rnbd-clt.c:1241 find_and_get_or_create_sess() error: 'sess' dereferencing possible ERR_PTR()

vim +1429 drivers/block/rnbd/rnbd-clt.c

  1401	
  1402	static struct rnbd_clt_dev *init_dev(struct rnbd_clt_session *sess,
  1403					      enum rnbd_access_mode access_mode,
  1404					      const char *pathname,
  1405					      u32 nr_poll_queues)
  1406	{
  1407		struct rnbd_clt_dev *dev;
  1408		int ret;
  1409	
  1410		dev = kzalloc_node(sizeof(*dev), GFP_KERNEL, NUMA_NO_NODE);
  1411		if (!dev)
  1412			return ERR_PTR(-ENOMEM);
  1413	
  1414		/*
  1415		 * nr_cpu_ids: the number of softirq queues
  1416		 * nr_poll_queues: the number of polling queues
  1417		 */
  1418		dev->hw_queues = kcalloc(nr_cpu_ids + nr_poll_queues,
  1419					 sizeof(*dev->hw_queues),
  1420					 GFP_KERNEL);
  1421		if (!dev->hw_queues) {
  1422			ret = -ENOMEM;
  1423			goto out_alloc;
  1424		}
  1425	
  1426		dev->clt_device_id = ida_alloc_max(&index_ida,
  1427						   (1 << (MINORBITS - RNBD_PART_BITS)) - 1,
  1428						   GFP_KERNEL);
> 1429		if (dev->clt_device_id < 0) {
  1430			ret = dev->clt_device_id;
  1431			pr_err("Failed to initialize device '%s' from session %s, allocating idr failed, err: %d\n",
  1432			       pathname, sess->sessname, ret);
  1433			goto out_queues;
  1434		}
  1435	
  1436		dev->pathname = kstrdup(pathname, GFP_KERNEL);
  1437		if (!dev->pathname) {
  1438			ret = -ENOMEM;
  1439			goto out_ida;
  1440		}
  1441	
  1442		dev->sess		= sess;
  1443		dev->access_mode	= access_mode;
  1444		dev->nr_poll_queues	= nr_poll_queues;
  1445		mutex_init(&dev->lock);
  1446		refcount_set(&dev->refcount, 1);
  1447		dev->dev_state = DEV_STATE_INIT;
  1448	
  1449		/*
  1450		 * Here we called from sysfs entry, thus clt-sysfs is
  1451		 * responsible that session will not disappear.
  1452		 */
  1453		WARN_ON(!rnbd_clt_get_sess(sess));
  1454	
  1455		return dev;
  1456	
  1457	out_ida:
  1458		ida_free(&index_ida, dev->clt_device_id);
  1459	out_queues:
  1460		kfree(dev->hw_queues);
  1461	out_alloc:
  1462		kfree(dev);
  1463		return ERR_PTR(ret);
  1464	}
  1465	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki