CC: [email protected] CC: [email protected] CC: Linux Memory Management List <[email protected]> TO: Marcos Paulo de Souza <[email protected]> CC: David Sterba <[email protected]>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master head: 8d4b477da1a807199ca60e0829357ce7aa6758d5 commit: 2315a282149bab4e37c8ecd5c6cad4e62704c65a [4029/4668] btrfs: introduce btrfs_search_backwards function :::::: branch date: 27 hours ago :::::: commit date: 2 days ago config: x86_64-randconfig-c001-20210729 (attached as .config) compiler: clang version 13.0.0 (https://github.com/llvm/llvm-project c49df15c278857adecd12db6bb1cdc96885f7079) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # install x86_64 cross compiling tool for clang build # apt-get install binutils-x86-64-linux-gnu # https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=2315a282149bab4e37c8ecd5c6cad4e62704c65a git remote add linux-next https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git git fetch --no-tags linux-next master git checkout 2315a282149bab4e37c8ecd5c6cad4e62704c65a # save the attached .config to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=x86_64 clang-analyzer If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <[email protected]> clang-analyzer warnings: (new ones prefixed by >>) ^ drivers/hid/hid-ite.c:50:6: note: Assuming the condition is true (usage->hid & HID_USAGE_PAGE) == 0x00880000) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/hid/hid-ite.c:49:2: note: Taking true branch if ((quirks & QUIRK_TOUCHPAD_ON_OFF_REPORT) && ^ drivers/hid/hid-ite.c:51:7: note: Assuming field 'hid' is equal to 8913016 if (usage->hid == 0x00880078) { ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/hid/hid-ite.c:51:3: note: Taking true branch if (usage->hid == 0x00880078) { ^ drivers/hid/hid-ite.c:53:4: note: Calling 'hid_map_usage_clear' hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_F22); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/hid.h:1035:2: note: Calling 'hid_map_usage' hid_map_usage(hidinput, usage, bit, max, type, c); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/hid.h:982:2: note: 'input' initialized here struct input_dev *input = hidinput->input; ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/hid.h:986:2: note: Control jumps to 'case 1:' at line 995 switch (type) { ^ include/linux/hid.h:998:3: note: Execution continues on line 1005 break; ^ include/linux/hid.h:1005:15: note: 'c' is <= 'limit' if (unlikely(c > limit || !bmap)) { ^ include/linux/compiler.h:78:42: note: expanded from macro 'unlikely' # define unlikely(x) __builtin_expect(!!(x), 0) ^ include/linux/hid.h:1005:15: note: Left side of '||' is false if (unlikely(c > limit || !bmap)) { ^ include/linux/hid.h:1005:28: note: Assuming 'bmap' is null if (unlikely(c > limit || !bmap)) { ^ include/linux/compiler.h:78:42: note: expanded from macro 'unlikely' # define unlikely(x) __builtin_expect(!!(x), 0) ^ include/linux/hid.h:1005:28: note: Assuming pointer value is null if (unlikely(c > limit || !bmap)) { ^ include/linux/compiler.h:78:42: note: expanded from macro 'unlikely' # define unlikely(x) __builtin_expect(!!(x), 0) ^ include/linux/hid.h:1005:2: note: Taking true branch if (unlikely(c > limit || !bmap)) { ^ include/linux/hid.h:1006:3: note: Assuming the condition is true pr_warn_ratelimited("%s: Invalid code %d type %d\n", ^ include/linux/printk.h:557:2: note: expanded from macro 'pr_warn_ratelimited' printk_ratelimited(KERN_WARNING pr_fmt(fmt), ##__VA_ARGS__) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/printk.h:540:6: note: expanded from macro 'printk_ratelimited' if (__ratelimit(&_rs)) \ ^~~~~~~~~~~~~~~~~ include/linux/ratelimit_types.h:41:28: note: expanded from macro '__ratelimit' #define __ratelimit(state) ___ratelimit(state, __func__) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/hid.h:1006:3: note: Taking true branch pr_warn_ratelimited("%s: Invalid code %d type %d\n", ^ include/linux/printk.h:557:2: note: expanded from macro 'pr_warn_ratelimited' printk_ratelimited(KERN_WARNING pr_fmt(fmt), ##__VA_ARGS__) ^ include/linux/printk.h:540:2: note: expanded from macro 'printk_ratelimited' if (__ratelimit(&_rs)) \ ^ include/linux/hid.h:1007:9: note: Access to field 'name' results in a dereference of a null pointer (loaded from variable 'input') input->name, c, type); ^ include/linux/printk.h:557:49: note: expanded from macro 'pr_warn_ratelimited' printk_ratelimited(KERN_WARNING pr_fmt(fmt), ##__VA_ARGS__) ^~~~~~~~~~~ include/linux/printk.h:541:17: note: expanded from macro 'printk_ratelimited' printk(fmt, ##__VA_ARGS__); \ ^~~~~~~~~~~ Suppressed 4 warnings (4 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 9 warnings generated. fs/btrfs/ioctl.c:1420:16: warning: Value stored to 'cluster' during its initialization is never read [clang-analyzer-deadcode.DeadStores] unsigned long cluster = max_cluster; ^~~~~~~ ~~~~~~~~~~~ fs/btrfs/ioctl.c:1420:16: note: Value stored to 'cluster' during its initialization is never read unsigned long cluster = max_cluster; ^~~~~~~ ~~~~~~~~~~~ fs/btrfs/ioctl.c:2107:3: warning: Value stored to 'i' is never read [clang-analyzer-deadcode.DeadStores] i = nritems; ^ ~~~~~~~ fs/btrfs/ioctl.c:2107:3: note: Value stored to 'i' is never read i = nritems; ^ ~~~~~~~ >> fs/btrfs/ioctl.c:2421:3: warning: Value stored to 'dirid' is never read >> [clang-analyzer-deadcode.DeadStores] dirid = key.objectid; ^ ~~~~~~~~~~~~ fs/btrfs/ioctl.c:2421:3: note: Value stored to 'dirid' is never read dirid = key.objectid; ^ ~~~~~~~~~~~~ fs/btrfs/ioctl.c:4660:2: warning: Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119 [clang-analyzer-security.insecureAPI.strcpy] strcpy(super_block->label, label); ^~~~~~ fs/btrfs/ioctl.c:4660:2: note: Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119 strcpy(super_block->label, label); ^~~~~~ Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 19 warnings generated. fs/btrfs/ctree.h:2152:1: warning: Array access (via field 'pages') results in a null pointer dereference [clang-analyzer-core.NullDereference] BTRFS_SETGET_HEADER_FUNCS(header_nritems, struct btrfs_header, nritems, 32); ^ fs/btrfs/ctree.h:1612:31: note: expanded from macro 'BTRFS_SETGET_HEADER_FUNCS' const type *p = page_address(eb->pages[0]) + \ ^ fs/btrfs/tree-log.c:6288:6: note: Assuming 'path' is non-null if (!path) ^~~~~ fs/btrfs/tree-log.c:6288:2: note: Taking false branch if (!path) ^ fs/btrfs/tree-log.c:6294:2: note: Taking false branch if (IS_ERR(trans)) { ^ fs/btrfs/tree-log.c:6302:8: note: Calling 'walk_log_tree' ret = walk_log_tree(trans, log_root_tree, &wc); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/btrfs/tree-log.c:2892:6: note: Assuming 'path' is non-null if (!path) ^~~~~ fs/btrfs/tree-log.c:2892:2: note: Taking false branch if (!path) ^ fs/btrfs/tree-log.c:2901:2: note: Loop condition is true. Entering loop body while (1) { ^ fs/btrfs/tree-log.c:2903:7: note: 'wret' is <= 0 if (wret > 0) ^~~~ fs/btrfs/tree-log.c:2903:3: note: Taking false branch if (wret > 0) ^ fs/btrfs/tree-log.c:2905:7: note: 'wret' is >= 0 if (wret < 0) { ^~~~ fs/btrfs/tree-log.c:2905:3: note: Taking false branch if (wret < 0) { ^ fs/btrfs/tree-log.c:2910:10: note: Calling 'walk_up_log_tree' wret = walk_up_log_tree(trans, log, path, &level, wc); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/btrfs/tree-log.c:2831:19: note: Left side of '&&' is true for (i = *level; i < BTRFS_MAX_LEVEL - 1 && path->nodes[i]; i++) { ^ fs/btrfs/tree-log.c:2831:2: note: Loop condition is true. Entering loop body for (i = *level; i < BTRFS_MAX_LEVEL - 1 && path->nodes[i]; i++) { ^ fs/btrfs/tree-log.c:2833:7: note: Assuming the condition is false if (slot + 1 < btrfs_header_nritems(path->nodes[i])) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/btrfs/tree-log.c:2833:3: note: Taking false branch if (slot + 1 < btrfs_header_nritems(path->nodes[i])) { ^ fs/btrfs/tree-log.c:2842:8: note: 'ret' is 0 if (ret) ^~~ fs/btrfs/tree-log.c:2842:4: note: Taking false branch if (ret) ^ fs/btrfs/tree-log.c:2845:12: note: Field 'free' is 0 if (wc->free) { ^ fs/btrfs/tree-log.c:2845:4: note: Taking false branch if (wc->free) { ^ fs/btrfs/tree-log.c:2869:4: note: Storing null pointer value path->nodes[*level] = NULL; ^~~~~~~~~~~~~~~~~~~~~~~~~~ fs/btrfs/tree-log.c:2831:19: note: Left side of '&&' is true for (i = *level; i < BTRFS_MAX_LEVEL - 1 && path->nodes[i]; i++) { ^ fs/btrfs/tree-log.c:2831:2: note: Loop condition is true. Entering loop body for (i = *level; i < BTRFS_MAX_LEVEL - 1 && path->nodes[i]; i++) { ^ fs/btrfs/tree-log.c:2833:7: note: Assuming the condition is false if (slot + 1 < btrfs_header_nritems(path->nodes[i])) { vim +/dirid +2421 fs/btrfs/ioctl.c ac8e9819d71f90 Chris Mason 2010-02-28 2350 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2351 /* ac8e9819d71f90 Chris Mason 2010-02-28 2352 * Search INODE_REFs to identify path name of 'dirid' directory ac8e9819d71f90 Chris Mason 2010-02-28 2353 * in a 'tree_id' tree. and sets path name to 'name'. 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2354 */ 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2355 static noinline int btrfs_search_path_in_tree(struct btrfs_fs_info *info, 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2356 u64 tree_id, u64 dirid, char *name) 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2357 { 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2358 struct btrfs_root *root; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2359 struct btrfs_key key; ac8e9819d71f90 Chris Mason 2010-02-28 2360 char *ptr; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2361 int ret = -1; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2362 int slot; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2363 int len; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2364 int total_len = 0; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2365 struct btrfs_inode_ref *iref; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2366 struct extent_buffer *l; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2367 struct btrfs_path *path; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2368 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2369 if (dirid == BTRFS_FIRST_FREE_OBJECTID) { 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2370 name[0]='\0'; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2371 return 0; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2372 } 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2373 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2374 path = btrfs_alloc_path(); 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2375 if (!path) 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2376 return -ENOMEM; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2377 c8bcbfbd239ed6 Nikolay Borisov 2017-12-01 2378 ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX - 1]; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2379 56e9357a1e8167 David Sterba 2020-05-15 2380 root = btrfs_get_fs_root(info, tree_id, true); 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2381 if (IS_ERR(root)) { ad1e3d5672ddce Misono Tomohiro 2018-05-21 2382 ret = PTR_ERR(root); 88234012beaaf6 Josef Bacik 2020-01-24 2383 root = NULL; 88234012beaaf6 Josef Bacik 2020-01-24 2384 goto out; 88234012beaaf6 Josef Bacik 2020-01-24 2385 } 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2386 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2387 key.objectid = dirid; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2388 key.type = BTRFS_INODE_REF_KEY; 8ad6fcab564c5b Chris Mason 2010-03-18 2389 key.offset = (u64)-1; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2390 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2391 while (1) { 2315a282149bab Marcos Paulo de Souza 2021-07-29 2392 ret = btrfs_search_backwards(root, &key, path); 18674c6cc10e78 Filipe David Borba Manana 2013-08-14 2393 if (ret < 0) 18674c6cc10e78 Filipe David Borba Manana 2013-08-14 2394 goto out; 18674c6cc10e78 Filipe David Borba Manana 2013-08-14 2395 else if (ret > 0) { 18674c6cc10e78 Filipe David Borba Manana 2013-08-14 2396 ret = -ENOENT; 18674c6cc10e78 Filipe David Borba Manana 2013-08-14 2397 goto out; 18674c6cc10e78 Filipe David Borba Manana 2013-08-14 2398 } 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2399 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2400 l = path->nodes[0]; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2401 slot = path->slots[0]; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2402 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2403 iref = btrfs_item_ptr(l, slot, struct btrfs_inode_ref); 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2404 len = btrfs_inode_ref_name_len(l, iref); 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2405 ptr -= len + 1; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2406 total_len += len + 1; a696cf3529cecd Filipe David Borba Manana 2013-08-14 2407 if (ptr < name) { a696cf3529cecd Filipe David Borba Manana 2013-08-14 2408 ret = -ENAMETOOLONG; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2409 goto out; a696cf3529cecd Filipe David Borba Manana 2013-08-14 2410 } 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2411 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2412 *(ptr + len) = '/'; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2413 read_extent_buffer(l, ptr, (unsigned long)(iref + 1), len); 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2414 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2415 if (key.offset == BTRFS_FIRST_FREE_OBJECTID) 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2416 break; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2417 b3b4aa74b58bde David Sterba 2011-04-21 2418 btrfs_release_path(path); 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2419 key.objectid = key.offset; 8ad6fcab564c5b Chris Mason 2010-03-18 2420 key.offset = (u64)-1; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 @2421 dirid = key.objectid; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2422 } 77906a5075a4eb Li Zefan 2011-07-14 2423 memmove(name, ptr, total_len); 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2424 name[total_len] = '\0'; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2425 ret = 0; 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2426 out: 0024652895e347 Josef Bacik 2020-01-24 2427 btrfs_put_root(root); 98d377a0894e6b TARUISI Hiroaki 2009-11-18 2428 btrfs_free_path(path); ac8e9819d71f90 Chris Mason 2010-02-28 2429 return ret; ac8e9819d71f90 Chris Mason 2010-02-28 2430 } ac8e9819d71f90 Chris Mason 2010-02-28 2431 :::::: The code at line 2421 was first introduced by commit :::::: 98d377a0894e6bcca44eafd4d2eee74e8af4db83 Btrfs: add a function to lookup a directory path by following backrefs :::::: TO: TARUISI Hiroaki <[email protected]> :::::: CC: Chris Mason <[email protected]> --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/[email protected]
.config.gz
Description: application/gzip
_______________________________________________ kbuild mailing list -- [email protected] To unsubscribe send an email to [email protected]
