Re: [bug report] io_uring/zcrx: add support for multiple ifqs

[Pavel Begunkov <asml.silence@gmail.com>]

On 4/23/25 11:04, Pavel Begunkov wrote:
> On 4/23/25 08:15, Dan Carpenter wrote:
>> Hello Pavel Begunkov,
>>
>> Commit 9c2a1c508442 ("io_uring/zcrx: add support for multiple ifqs")
>> from Apr 20, 2025 (linux-next), leads to the following Smatch static
>> checker warning:
>>
>>     io_uring/zcrx.c:457 io_register_zcrx_ifq()
>>     error: uninitialized symbol 'id'.
>>
>> io_uring/zcrx.c
> ...
>>      396         ifq = io_zcrx_ifq_alloc(ctx);
>>      397         if (!ifq)
>>      398                 return -ENOMEM;
>>      399
>>      400         scoped_guard(mutex, &ctx->mmap_lock) {
>>      401                 /* preallocate id */
>>      402                 ret = xa_alloc(&ctx->zcrx_ctxs, &id, NULL, xa_limit_31b, GFP_KERNEL);
>>      403                 if (ret)
>>      404                         goto err;
>>
>> Potentially uninitialized on this path.  Presumably we don't need to
>> erase id if alloc fails.
> 
> Thanks for letting know

Jens, do you want a separate patch or to fix it up as it's the top
patch? This should do

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 39744302fad1..ac2a05364b24 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -450,7 +450,7 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
  		/* preallocate id */
  		ret = xa_alloc(&ctx->zcrx_ctxs, &id, NULL, xa_limit_31b, GFP_KERNEL);
  		if (ret)
-			goto err;
+			goto ifq_free;
  	}
  
  	ret = io_allocate_rbuf_ring(ifq, &reg, &rd, id);
@@ -506,6 +506,7 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
  err:
  	scoped_guard(mutex, &ctx->mmap_lock)
  		xa_erase(&ctx->zcrx_ctxs, id);
+ifq_free:
  	io_zcrx_ifq_free(ifq);
  	return ret;
  }

-- 
Pavel Begunkov