From patchwork Wed Oct 25 10:34:43 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dominique Martinet X-Patchwork-Id: 13435958 Received: from nautica.notk.org (nautica.notk.org [91.121.71.147]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0F922266C3 for ; Wed, 25 Oct 2023 10:35:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=codewreck.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=codewreck.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=codewreck.org header.i=@codewreck.org header.b="n4J43Ocj"; dkim=pass (2048-bit key) header.d=codewreck.org header.i=@codewreck.org header.b="0UFC36EI" Received: by nautica.notk.org (Postfix, from userid 108) id 4A2FBC021; Wed, 25 Oct 2023 12:34:59 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=codewreck.org; s=2; t=1698230099; bh=WMmE+1h6Xwn1xLkMKQHwODUtDZc1edPW0I8KanvCU4M=; h=From:To:Cc:Subject:Date:From; b=n4J43OcjALjXziE7yaAGF03U1OP8mDpOhObvXl36vrglDt92fFWnjRimMkCfpX/0m VA9JdAIVhQ19Ty1NF+jbJXquzaYpuNPk3EQdKMoSbafpUFMIeabnd19Q9bTBBe1y0B rOpCkUy9ikzRF4+AjJLxBRy5yVYRM24m8C5ks2yYVXfejw/AWmROU0Q8+pS4+l9XxQ iYaPoBbrTFOVbzkyljWAG81FgipDBGu82Raj/+fB+pMG6A5baT+R6cnoh3Fb0ffP9k swNSZtkJcjmgClH5dcppc9aX2b77677Dgfb2hpvRgDMVGkFSnTMFxlNGRn52pYiTTv O5nkYaDay9Pqw== X-Spam-Level: Received: from gaia (localhost [127.0.0.1]) by nautica.notk.org (Postfix) with ESMTPS id 6DE23C01C; Wed, 25 Oct 2023 12:34:55 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=codewreck.org; s=2; t=1698230098; bh=WMmE+1h6Xwn1xLkMKQHwODUtDZc1edPW0I8KanvCU4M=; h=From:To:Cc:Subject:Date:From; b=0UFC36EIExrT623/E5YD4kWC98wdcQIxvuWxRoUMUrtMY+ygAqx4LV/oprP8zC4Br cxQz/geWp84quDE4D5GTH+J8nARa7H7Lx/WVHsg5niBF/JMs8pRNI/EWx9qpsg2x/c rvLbcwlHjbB52t1y04hVjoltBUres7EGoW6jSxD0UquJnHgC1QHL2px3Dnjhdj+pfk boPjSRiQWtQnVNRbf/1as5QVYxEDDoDg0X7vvL0jzbGEecbgPsw4+BsDLvbEkZDNP7 DTcZb6TUmCtCLAMYdXxctutXwqj3h2qbC4Ytsmv9CfaUEdZfzo6419zGxVIzSckRL9 U+gJwkfYABf5g== Received: from gaia.codewreck.org (localhost.lan [::1]) by gaia (OpenSMTPD) with ESMTP id 2192dabf; Wed, 25 Oct 2023 10:34:52 +0000 (UTC) From: Dominique Martinet To: v9fs@lists.linux.dev Cc: ericvh@kernel.org, linux_oss@crudebyte.com, lucho@ionkov.net, linux-kernel@vger.kernel.org, Marco Elver , syzbot+e441aeeb422763cc5511@syzkaller.appspotmail.com, Dominique Martinet Subject: [PATCH v2 1/3] 9p/trans_fd: Annotate data-racy writes to file::f_flags Date: Wed, 25 Oct 2023 19:34:43 +0900 Message-ID: <20231025103445.1248103-1-asmadeus@codewreck.org> X-Mailer: git-send-email 2.41.0 Precedence: bulk X-Mailing-List: v9fs@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Marco Elver syzbot reported: | BUG: KCSAN: data-race in p9_fd_create / p9_fd_create | | read-write to 0xffff888130fb3d48 of 4 bytes by task 15599 on cpu 0: | p9_fd_open net/9p/trans_fd.c:842 [inline] | p9_fd_create+0x210/0x250 net/9p/trans_fd.c:1092 | p9_client_create+0x595/0xa70 net/9p/client.c:1010 | v9fs_session_init+0xf9/0xd90 fs/9p/v9fs.c:410 | v9fs_mount+0x69/0x630 fs/9p/vfs_super.c:123 | legacy_get_tree+0x74/0xd0 fs/fs_context.c:611 | vfs_get_tree+0x51/0x190 fs/super.c:1519 | do_new_mount+0x203/0x660 fs/namespace.c:3335 | path_mount+0x496/0xb30 fs/namespace.c:3662 | do_mount fs/namespace.c:3675 [inline] | __do_sys_mount fs/namespace.c:3884 [inline] | [...] | | read-write to 0xffff888130fb3d48 of 4 bytes by task 15563 on cpu 1: | p9_fd_open net/9p/trans_fd.c:842 [inline] | p9_fd_create+0x210/0x250 net/9p/trans_fd.c:1092 | p9_client_create+0x595/0xa70 net/9p/client.c:1010 | v9fs_session_init+0xf9/0xd90 fs/9p/v9fs.c:410 | v9fs_mount+0x69/0x630 fs/9p/vfs_super.c:123 | legacy_get_tree+0x74/0xd0 fs/fs_context.c:611 | vfs_get_tree+0x51/0x190 fs/super.c:1519 | do_new_mount+0x203/0x660 fs/namespace.c:3335 | path_mount+0x496/0xb30 fs/namespace.c:3662 | do_mount fs/namespace.c:3675 [inline] | __do_sys_mount fs/namespace.c:3884 [inline] | [...] | | value changed: 0x00008002 -> 0x00008802 Within p9_fd_open(), O_NONBLOCK is added to f_flags of the read and write files. This may happen concurrently if e.g. mounting process modifies the fd in another thread. Mark the plain read-modify-writes as intentional data-races, with the assumption that the result of executing the accesses concurrently will always result in the same result despite the accesses themselves not being atomic. Reported-by: syzbot+e441aeeb422763cc5511@syzkaller.appspotmail.com Signed-off-by: Marco Elver Link: https://lore.kernel.org/r/ZO38mqkS0TYUlpFp@elver.google.com Signed-off-by: Dominique Martinet --- v1 -> v2: - reworded comment as discussed - adjusted commit subject line to match with other trans_fd patch (there is no change from the one I sent yesterday, I'm just resending the whole set properly now there's been feedback on other commits) net/9p/trans_fd.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c index f226953577b2..1a3948b8c493 100644 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@ -836,14 +836,21 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd) goto out_free_ts; if (!(ts->rd->f_mode & FMODE_READ)) goto out_put_rd; - /* prevent workers from hanging on IO when fd is a pipe */ - ts->rd->f_flags |= O_NONBLOCK; + /* Prevent workers from hanging on IO when fd is a pipe. + * It's technically possible for userspace or concurrent mounts to + * modify this flag concurrently, which will likely result in a + * broken filesystem. However, just having bad flags here should + * not crash the kernel or cause any other sort of bug, so mark this + * particular data race as intentional so that tooling (like KCSAN) + * can allow it and detect further problems. + */ + data_race(ts->rd->f_flags |= O_NONBLOCK); ts->wr = fget(wfd); if (!ts->wr) goto out_put_rd; if (!(ts->wr->f_mode & FMODE_WRITE)) goto out_put_wr; - ts->wr->f_flags |= O_NONBLOCK; + data_race(ts->wr->f_flags |= O_NONBLOCK); client->trans = ts; client->status = Connected; From patchwork Wed Oct 25 10:34:44 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Dominique Martinet X-Patchwork-Id: 13435959 Received: from nautica.notk.org (nautica.notk.org [91.121.71.147]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1222726E01 for ; Wed, 25 Oct 2023 10:35:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=codewreck.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=codewreck.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=codewreck.org header.i=@codewreck.org header.b="05fdU/yQ"; dkim=pass (2048-bit key) header.d=codewreck.org header.i=@codewreck.org header.b="ftS3Ik6j" Received: by nautica.notk.org (Postfix, from userid 108) id 5820BC026; Wed, 25 Oct 2023 12:35:05 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=codewreck.org; s=2; t=1698230105; bh=3oLYARw9PzD4D8IthO/c8mEblFd4Phw87VXReD+sQhw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=05fdU/yQjJiqOCG03enYdZacSd1qfY1SzIL0y5XgjDN/n0LF65kPG6JOT6GmAYiDB 70dDjRU9/fLJfc34yCCTceY4GbXRZPrZIgl+W6Cc4Al/PaMNTcNSPu4SCKtBQBT7MZ dLeq4wQJq+fP/WYKq0SorF8NbnCr4/CRTahc9aAmIpuULiE1HIKASnaCxz/IstGNl0 a1hy6r9YHMTGuXUSF4+2ubF03vnaYuoDdmloNIprABlXFh83llzlmOHUVqR+fSjQoj Ba0/v85njq3KJjQtwLCB3wzDl0Zk0NxWEmBU5Zq+oAq28s9vrZvgamw6+qLsYpOoX8 UI0CCtwa1d5Dg== X-Spam-Level: Received: from gaia (localhost [127.0.0.1]) by nautica.notk.org (Postfix) with ESMTPS id 702E0C024; Wed, 25 Oct 2023 12:34:58 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=codewreck.org; s=2; t=1698230103; bh=3oLYARw9PzD4D8IthO/c8mEblFd4Phw87VXReD+sQhw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ftS3Ik6jc4yYla/PPazBt/OthUxEG067GBsfnsOqHJIz4AVJmp6GWCI0DVjHXif1T wwSBh06ASdAHBj71eGJ98SXEU5O0BaiB7Bmofahi7qnXV6kwV6BB0i6vKv2A6u+0BA WSJlBusYTdphzYsWVnjgGpWhAB1pbgw6C1db23FH3d3BtC9ZAQYjG0BQW2kJXgo/v7 DEH8sjt6hP9y+SdTncCP01hiKZK29SPn1nWLo8QIvIKAEJ3wL8iSaDy0FwuteaFCbD dgZCupEqf9vgT7Zt+oYSz4Nri9vomfvsWVLF6kpaHiI01F22vtRoMUPT+hBKY9/l1P Cl2IRDP2IEIUw== Received: from gaia.codewreck.org (localhost.lan [::1]) by gaia (OpenSMTPD) with ESMTP id 9e57d534; Wed, 25 Oct 2023 10:34:52 +0000 (UTC) From: Dominique Martinet To: v9fs@lists.linux.dev Cc: ericvh@kernel.org, linux_oss@crudebyte.com, lucho@ionkov.net, linux-kernel@vger.kernel.org, Dominique Martinet , Su Hui Subject: [PATCH v2 2/3] 9p: v9fs_listxattr: fix %s null argument warning Date: Wed, 25 Oct 2023 19:34:44 +0900 Message-ID: <20231025103445.1248103-2-asmadeus@codewreck.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20231025103445.1248103-1-asmadeus@codewreck.org> References: <20231025103445.1248103-1-asmadeus@codewreck.org> Precedence: bulk X-Mailing-List: v9fs@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 W=1 warns about null argument to kprintf: In file included from fs/9p/xattr.c:12: In function ‘v9fs_xattr_get’, inlined from ‘v9fs_listxattr’ at fs/9p/xattr.c:142:9: include/net/9p/9p.h:55:2: error: ‘%s’ directive argument is null [-Werror=format-overflow=] 55 | _p9_debug(level, __func__, fmt, ##__VA_ARGS__) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Use an empty string instead of : - this is ok 9p-wise because p9pdu_vwritef serializes a null string and an empty string the same way (one '0' word for length) - since this degrades the print statements, add new single quotes for xattr's name delimter (Old: "file = (null)", new: "file = ''") Signed-off-by: Dominique Martinet Link: https://lore.kernel.org/r/20231008060138.517057-1-suhui@nfschina.com Suggested-by: Su Hui Acked-by: Christian Schoenebeck --- v1->v2: - add comment that txattrwalk with an empty string gets the list fs/9p/xattr.c | 5 +++-- net/9p/client.c | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/9p/xattr.c b/fs/9p/xattr.c index e00cf8109b3f..3c4572ef3a48 100644 --- a/fs/9p/xattr.c +++ b/fs/9p/xattr.c @@ -68,7 +68,7 @@ ssize_t v9fs_xattr_get(struct dentry *dentry, const char *name, struct p9_fid *fid; int ret; - p9_debug(P9_DEBUG_VFS, "name = %s value_len = %zu\n", + p9_debug(P9_DEBUG_VFS, "name = '%s' value_len = %zu\n", name, buffer_size); fid = v9fs_fid_lookup(dentry); if (IS_ERR(fid)) @@ -139,7 +139,8 @@ int v9fs_fid_xattr_set(struct p9_fid *fid, const char *name, ssize_t v9fs_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size) { - return v9fs_xattr_get(dentry, NULL, buffer, buffer_size); + /* Txattrwalk with an empty string lists xattrs instead */ + return v9fs_xattr_get(dentry, "", buffer, buffer_size); } static int v9fs_xattr_handler_get(const struct xattr_handler *handler, diff --git a/net/9p/client.c b/net/9p/client.c index 86bbc7147fc1..9c2bc15e3cfa 100644 --- a/net/9p/client.c +++ b/net/9p/client.c @@ -1979,7 +1979,7 @@ struct p9_fid *p9_client_xattrwalk(struct p9_fid *file_fid, goto error; } p9_debug(P9_DEBUG_9P, - ">>> TXATTRWALK file_fid %d, attr_fid %d name %s\n", + ">>> TXATTRWALK file_fid %d, attr_fid %d name '%s'\n", file_fid->fid, attr_fid->fid, attr_name); req = p9_client_rpc(clnt, P9_TXATTRWALK, "dds", From patchwork Wed Oct 25 10:34:45 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Dominique Martinet X-Patchwork-Id: 13435960 Received: from nautica.notk.org (nautica.notk.org [91.121.71.147]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B6AEA266BC for ; Wed, 25 Oct 2023 10:35:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=codewreck.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=codewreck.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=codewreck.org header.i=@codewreck.org header.b="V4ob44En"; dkim=pass (2048-bit key) header.d=codewreck.org header.i=@codewreck.org header.b="ZurXGHQv" Received: by nautica.notk.org (Postfix, from userid 108) id 1F8C9C02C; Wed, 25 Oct 2023 12:35:06 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=codewreck.org; s=2; t=1698230106; bh=alDC8/pUNCLU3G+aaZxX11BvuNObZgKMGq1KaeSAe4U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=V4ob44EnsAlv0DLYwv9MwUWumioP+1pIvVZpDstuu8eObyIa4eA3vphY/AUy6WNaH 56lu/BH36rs54EWmAVP0tZisDWrTMrJvYbiZBTX+o7XXrgGXDs0zTgC+PMHujZfBuL M7aCnF7gakPNQ8+5IxQWF+1RhuKQn84lwIrm3izRxcvpZjOV/+AuQ6/c4oKxc6yx95 ICCQR5m0kVo8c9o4E9VGF4rjzFEpu00+AD+bzpnFeorprOYfN7qu5HEW7YX2ZLiSKV LwV1Lbp/b111+VPEJdEDLO0WDB3ICbFcOnNes4GfC0gPecqFMUhZ5Dimdbm1Jv3Izn 24ozAh7TAi0wQ== X-Spam-Level: Received: from gaia (localhost [127.0.0.1]) by nautica.notk.org (Postfix) with ESMTPS id CECA9C01F; Wed, 25 Oct 2023 12:35:00 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=codewreck.org; s=2; t=1698230104; bh=alDC8/pUNCLU3G+aaZxX11BvuNObZgKMGq1KaeSAe4U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZurXGHQvdNpON1tO8sq6IhplF33P2ECIOGjNuOPLKzS3T3SiYIhcGnsoVAUANBEN6 o2JyvYYypXjt9XM1yLBG4txzkVOtzYBrVGbCtB0h+BdZv5ATm70fEPRiYIy7BXjqCC mtFxmd2jvWnD3hrfq62FSomadTMiFdZm7e//dwSUGeWPuC17aVbdWWElUKFTvmfKMC AsjuaCkZX5WoZ9sVvBjWF0wePWH8ItH+HDI6nYzOQ4oWxQNmBcBP4ZGuW7Sr4QPx+y XFrd+cr0roJ9+NdbuWYhxiFMIuCoMwbKokAm9RgeFdGUO+L0saDYpoW7I9tz/5P8BL yYdyaUtmLp6UQ== Received: from gaia.codewreck.org (localhost.lan [::1]) by gaia (OpenSMTPD) with ESMTP id c2b62181; Wed, 25 Oct 2023 10:34:53 +0000 (UTC) From: Dominique Martinet To: v9fs@lists.linux.dev Cc: ericvh@kernel.org, linux_oss@crudebyte.com, lucho@ionkov.net, linux-kernel@vger.kernel.org, Dominique Martinet Subject: [PATCH v2 3/3] 9p/net: xen: fix false positive printf format overflow warning Date: Wed, 25 Oct 2023 19:34:45 +0900 Message-ID: <20231025103445.1248103-3-asmadeus@codewreck.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20231025103445.1248103-1-asmadeus@codewreck.org> References: <20231025103445.1248103-1-asmadeus@codewreck.org> Precedence: bulk X-Mailing-List: v9fs@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Use the constant to make the compiler happy about this warning: net/9p/trans_xen.c: In function ‘xen_9pfs_front_changed’: net/9p/trans_xen.c:444:39: warning: ‘%d’ directive writing between 1 and 11 bytes into a region of size 8 [-Wformat-overflow=] 444 | sprintf(str, "ring-ref%d", i); | ^~ In function ‘xen_9pfs_front_init’, inlined from ‘xen_9pfs_front_changed’ at net/9p/trans_xen.c:516:8, inlined from ‘xen_9pfs_front_changed’ at net/9p/trans_xen.c:504:13: net/9p/trans_xen.c:444:30: note: directive argument in the range [-2147483644, 2147483646] 444 | sprintf(str, "ring-ref%d", i); | ^~~~~~~~~~~~ net/9p/trans_xen.c:444:17: note: ‘sprintf’ output between 10 and 20 bytes into a destination of size 16 444 | sprintf(str, "ring-ref%d", i); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ net/9p/trans_xen.c: In function ‘xen_9pfs_front_changed’: net/9p/trans_xen.c:450:45: warning: ‘%d’ directive writing between 1 and 11 bytes into a region of size 2 [-Wformat-overflow=] 450 | sprintf(str, "event-channel-%d", i); | ^~ In function ‘xen_9pfs_front_init’, inlined from ‘xen_9pfs_front_changed’ at net/9p/trans_xen.c:516:8, inlined from ‘xen_9pfs_front_changed’ at net/9p/trans_xen.c:504:13: net/9p/trans_xen.c:450:30: note: directive argument in the range [-2147483644, 2147483646] 450 | sprintf(str, "event-channel-%d", i); | ^~~~~~~~~~~~~~~~~~ net/9p/trans_xen.c:450:17: note: ‘sprintf’ output between 16 and 26 bytes into a destination of size 16 450 | sprintf(str, "event-channel-%d", i); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ There is no change in logic: there only are a constant number of rings, and there also already is a BUILD_BUG_ON that checks if that constant goes over 9 as anything bigger would no longer fit the event-channel-%d destination size. In theory having that size as part of the struct means it could be modified by another thread and makes the compiler lose track of possible values for 'i' here, using the constant directly here makes it work. Signed-off-by: Dominique Martinet Message-ID: <20231023233704.1185154-4-asmadeus@codewreck.org> Reviewed-by: Christian Schoenebeck --- v1->v2: - use constant directly instead of going through a local variable net/9p/trans_xen.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index 1fffe2bed5b0..dfdbe1ca5338 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -54,7 +54,6 @@ struct xen_9pfs_front_priv { char *tag; struct p9_client *client; - int num_rings; struct xen_9pfs_dataring *rings; }; @@ -131,7 +130,7 @@ static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req) if (list_entry_is_head(priv, &xen_9pfs_devs, list)) return -EINVAL; - num = p9_req->tc.tag % priv->num_rings; + num = p9_req->tc.tag % XEN_9PFS_NUM_RINGS; ring = &priv->rings[num]; again: @@ -279,7 +278,7 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) list_del(&priv->list); write_unlock(&xen_9pfs_lock); - for (i = 0; i < priv->num_rings; i++) { + for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) { struct xen_9pfs_dataring *ring = &priv->rings[i]; cancel_work_sync(&ring->work); @@ -408,15 +407,14 @@ static int xen_9pfs_front_init(struct xenbus_device *dev) if (p9_xen_trans.maxsize > XEN_FLEX_RING_SIZE(max_ring_order)) p9_xen_trans.maxsize = XEN_FLEX_RING_SIZE(max_ring_order) / 2; - priv->num_rings = XEN_9PFS_NUM_RINGS; - priv->rings = kcalloc(priv->num_rings, sizeof(*priv->rings), + priv->rings = kcalloc(XEN_9PFS_NUM_RINGS, sizeof(*priv->rings), GFP_KERNEL); if (!priv->rings) { kfree(priv); return -ENOMEM; } - for (i = 0; i < priv->num_rings; i++) { + for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) { priv->rings[i].priv = priv; ret = xen_9pfs_front_alloc_dataring(dev, &priv->rings[i], max_ring_order); @@ -434,10 +432,11 @@ static int xen_9pfs_front_init(struct xenbus_device *dev) if (ret) goto error_xenbus; ret = xenbus_printf(xbt, dev->nodename, "num-rings", "%u", - priv->num_rings); + XEN_9PFS_NUM_RINGS); if (ret) goto error_xenbus; - for (i = 0; i < priv->num_rings; i++) { + + for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) { char str[16]; BUILD_BUG_ON(XEN_9PFS_NUM_RINGS > 9);