CC: [email protected]
CC: [email protected]
CC: [email protected]
TO: Kees Cook <[email protected]>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git 
kspp/memcpy/next-20210726/v1
head:   831e05d47f76f6e7452fedbcb471dd405242bfaf
commit: 831e05d47f76f6e7452fedbcb471dd405242bfaf [64/64] fortify: Add run-time 
WARN for cross-field memcpy()
:::::: branch date: 5 days ago
:::::: commit date: 5 days ago
config: x86_64-randconfig-c001-20210728 (attached as .config)
compiler: clang version 13.0.0 (https://github.com/llvm/llvm-project 
c49df15c278857adecd12db6bb1cdc96885f7079)
reproduce (this is a W=1 build):
        wget 
https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O 
~/bin/make.cross
        chmod +x ~/bin/make.cross
        # install x86_64 cross compiling tool for clang build
        # apt-get install binutils-x86-64-linux-gnu
        # 
https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/commit/?id=831e05d47f76f6e7452fedbcb471dd405242bfaf
        git remote add kees 
https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git
        git fetch --no-tags kees kspp/memcpy/next-20210726/v1
        git checkout 831e05d47f76f6e7452fedbcb471dd405242bfaf
        # save the attached .config to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=x86_64 
clang-analyzer 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <[email protected]>


clang-analyzer warnings: (new ones prefixed by >>)
   hw_buf_hi, 
   consider reordering the fields or adding explicit padding members 
[clang-analyzer-optin.performance.Padding]
   struct ehci_qtd {
   ~~~~~~~^~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:234:8: note: Excessive padding in 'struct 
ehci_qtd' (32 padding bytes, where 0 is optimal). Optimal fields order: 
qtd_dma, urb, length, buffer, buffer_dma, transfer_buffer, transfer_dma, 
qtd_list, hw_next, hw_alt_next, hw_token, qtd_buffer_len, hw_buf, hw_buf_hi, 
consider reordering the fields or adding explicit padding members
   struct ehci_qtd {
   ~~~~~~~^~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:2089:15: warning: Access to field 'qh_state' 
results in a dereference of a null pointer (loaded from variable 'qh') 
[clang-analyzer-core.NullDereference]
           qh->qh_state = QH_STATE_IDLE;
                        ^
   drivers/usb/host/oxu210hp-hcd.c:3863:2: note: Taking false branch
           oxu_dbg(oxu, "suspend root hub\n");
           ^
   drivers/usb/host/oxu210hp-hcd.c:483:3: note: expanded from macro 'oxu_dbg'
                   dev_dbg(oxu_to_hcd(oxu)->self.controller , fmt , ## args)
                   ^
   include/linux/dev_printk.h:162:2: note: expanded from macro 'dev_dbg'
           if (0)                                                          \
           ^
   drivers/usb/host/oxu210hp-hcd.c:3865:6: note: Left side of '&&' is true
           if (time_before(jiffies, oxu->next_statechange))
               ^
   include/linux/jiffies.h:108:26: note: expanded from macro 'time_before'
   #define time_before(a,b)        time_after(b,a)
                                   ^
   include/linux/jiffies.h:105:3: note: expanded from macro 'time_after'
           (typecheck(unsigned long, a) && \
            ^
   include/linux/typecheck.h:9:27: note: expanded from macro 'typecheck'
   #define typecheck(type,x) \
                             ^
   drivers/usb/host/oxu210hp-hcd.c:3865:6: note: Left side of '&&' is true
           if (time_before(jiffies, oxu->next_statechange))
               ^
   include/linux/jiffies.h:108:26: note: expanded from macro 'time_before'
   #define time_before(a,b)        time_after(b,a)
                                   ^
   include/linux/jiffies.h:105:3: note: expanded from macro 'time_after'
           (typecheck(unsigned long, a) && \
            ^
   include/linux/typecheck.h:9:27: note: expanded from macro 'typecheck'
   #define typecheck(type,x) \
                             ^
   drivers/usb/host/oxu210hp-hcd.c:3865:2: note: Taking false branch
           if (time_before(jiffies, oxu->next_statechange))
           ^
   drivers/usb/host/oxu210hp-hcd.c:3869:2: note: Calling 'spin_lock_irq'
           spin_lock_irq(&oxu->lock);
           ^~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/spinlock.h:384:2: note: Value assigned to field 'reclaim'
           raw_spin_lock_irq(&lock->rlock);
           ^
   include/linux/spinlock.h:282:34: note: expanded from macro 
'raw_spin_lock_irq'
   #define raw_spin_lock_irq(lock)         _raw_spin_lock_irq(lock)
                                           ^~~~~~~~~~~~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:3869:2: note: Returning from 'spin_lock_irq'
           spin_lock_irq(&oxu->lock);
           ^~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:3872:6: note: Assuming the condition is false
           if (HC_IS_RUNNING(hcd->state)) {
               ^
   include/linux/usb/hcd.h:216:31: note: expanded from macro 'HC_IS_RUNNING'
   #define HC_IS_RUNNING(state) ((state) & __ACTIVE)
                                 ^~~~~~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:3872:2: note: Taking false branch
           if (HC_IS_RUNNING(hcd->state)) {
           ^
   drivers/usb/host/oxu210hp-hcd.c:3877:6: note: Assuming field 'reclaim' is 
null
           if (oxu->reclaim)
               ^~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:3877:2: note: Taking false branch
           if (oxu->reclaim)
           ^
   drivers/usb/host/oxu210hp-hcd.c:3879:2: note: Calling 'ehci_work'
           ehci_work(oxu);
           ^~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:2802:2: note: Calling 'timer_action_done'
           timer_action_done(oxu, TIMER_IO_WATCHDOG);
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:694:1: note: Returning without writing to 
'oxu->reclaim'
   }
   ^
   drivers/usb/host/oxu210hp-hcd.c:2802:2: note: Returning from 
'timer_action_done'
           timer_action_done(oxu, TIMER_IO_WATCHDOG);
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:2803:6: note: Assuming field 'reclaim_ready' 
is not equal to 0
           if (oxu->reclaim_ready)
               ^~~~~~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:2803:2: note: Taking true branch
           if (oxu->reclaim_ready)
           ^
   drivers/usb/host/oxu210hp-hcd.c:2804:3: note: Calling 'end_unlink_async'
                   end_unlink_async(oxu);
                   ^~~~~~~~~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:2084:2: note: 'qh' initialized to a null 
pointer value
           struct ehci_qh *qh = oxu->reclaim;
           ^~~~~~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:2089:15: note: Access to field 'qh_state' 
results in a dereference of a null pointer (loaded from variable 'qh')
           qh->qh_state = QH_STATE_IDLE;
           ~~           ^
>> drivers/usb/host/oxu210hp-hcd.c:2153:9: warning: Dereference of null pointer 
>> [clang-analyzer-core.NullDereference]
           while (prev->qh_next.qh != qh)
                  ^
   drivers/usb/host/oxu210hp-hcd.c:3863:2: note: Taking false branch
           oxu_dbg(oxu, "suspend root hub\n");
           ^
   drivers/usb/host/oxu210hp-hcd.c:483:3: note: expanded from macro 'oxu_dbg'
                   dev_dbg(oxu_to_hcd(oxu)->self.controller , fmt , ## args)
                   ^
   include/linux/dev_printk.h:162:2: note: expanded from macro 'dev_dbg'
           if (0)                                                          \
           ^
   drivers/usb/host/oxu210hp-hcd.c:3865:6: note: Left side of '&&' is true
           if (time_before(jiffies, oxu->next_statechange))
               ^
   include/linux/jiffies.h:108:26: note: expanded from macro 'time_before'
   #define time_before(a,b)        time_after(b,a)
                                   ^
   include/linux/jiffies.h:105:3: note: expanded from macro 'time_after'
           (typecheck(unsigned long, a) && \
            ^
   include/linux/typecheck.h:9:27: note: expanded from macro 'typecheck'
   #define typecheck(type,x) \
                             ^
   drivers/usb/host/oxu210hp-hcd.c:3865:6: note: Left side of '&&' is true
           if (time_before(jiffies, oxu->next_statechange))
               ^
   include/linux/jiffies.h:108:26: note: expanded from macro 'time_before'
   #define time_before(a,b)        time_after(b,a)
                                   ^
   include/linux/jiffies.h:105:3: note: expanded from macro 'time_after'
           (typecheck(unsigned long, a) && \
            ^
   include/linux/typecheck.h:9:27: note: expanded from macro 'typecheck'
   #define typecheck(type,x) \
                             ^
   drivers/usb/host/oxu210hp-hcd.c:3865:2: note: Taking false branch
           if (time_before(jiffies, oxu->next_statechange))
           ^
   drivers/usb/host/oxu210hp-hcd.c:3872:6: note: Assuming the condition is false
           if (HC_IS_RUNNING(hcd->state)) {
               ^
   include/linux/usb/hcd.h:216:31: note: expanded from macro 'HC_IS_RUNNING'
   #define HC_IS_RUNNING(state) ((state) & __ACTIVE)
                                 ^~~~~~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:3872:2: note: Taking false branch
           if (HC_IS_RUNNING(hcd->state)) {
           ^
   drivers/usb/host/oxu210hp-hcd.c:3877:6: note: Assuming field 'reclaim' is 
non-null
           if (oxu->reclaim)
               ^~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:3877:2: note: Taking true branch
           if (oxu->reclaim)
           ^
   drivers/usb/host/oxu210hp-hcd.c:3879:2: note: Calling 'ehci_work'
           ehci_work(oxu);
           ^~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:2803:11: note: Field 'reclaim_ready' is 1
           if (oxu->reclaim_ready)
                    ^
   drivers/usb/host/oxu210hp-hcd.c:2803:2: note: Taking true branch
           if (oxu->reclaim_ready)
           ^
   drivers/usb/host/oxu210hp-hcd.c:2804:3: note: Calling 'end_unlink_async'
                   end_unlink_async(oxu);
                   ^~~~~~~~~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:2101:6: note: Assuming the condition is false
           if (!list_empty(&qh->qtd_list)
               ^~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:2102:4: note: Left side of '&&' is false
                           && HC_IS_RUNNING(oxu_to_hcd(oxu)->state))
                           ^
   drivers/usb/host/oxu210hp-hcd.c:2110:7: note: Assuming the condition is true
                   if (HC_IS_RUNNING(oxu_to_hcd(oxu)->state)
                       ^
   include/linux/usb/hcd.h:216:31: note: expanded from macro 'HC_IS_RUNNING'
   #define HC_IS_RUNNING(state) ((state) & __ACTIVE)
                                 ^~~~~~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:2110:7: note: Left side of '&&' is true
                   if (HC_IS_RUNNING(oxu_to_hcd(oxu)->state)
                       ^
   include/linux/usb/hcd.h:216:30: note: expanded from macro 'HC_IS_RUNNING'
   #define HC_IS_RUNNING(state) ((state) & __ACTIVE)
                                ^
   drivers/usb/host/oxu210hp-hcd.c:2111:8: note: Assuming field 'qh' is equal 
to NULL
                                   && oxu->async->qh_next.qh == NULL)
                                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:2110:3: note: Taking true branch
                   if (HC_IS_RUNNING(oxu_to_hcd(oxu)->state)
                   ^
   drivers/usb/host/oxu210hp-hcd.c:2115:6: note: Assuming 'next' is non-null
           if (next) {
               ^~~~
   drivers/usb/host/oxu210hp-hcd.c:2115:2: note: Taking true branch
           if (next) {
           ^
   drivers/usb/host/oxu210hp-hcd.c:2117:3: note: Calling 'start_unlink_async'
                   start_unlink_async(oxu, next);
                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/usb/host/oxu210hp-hcd.c:2136:15: note: Assuming 'qh' is not equal to 
field 'async'
           if (unlikely(qh == oxu->async)) {
--
   drivers/iio/adc/ti-ads1015.c:350:6: note: 'chan' is >= 0
           if (chan < 0 || chan >= ADS1015_CHANNELS)
               ^~~~
   drivers/iio/adc/ti-ads1015.c:350:6: note: Left side of '||' is false
   drivers/iio/adc/ti-ads1015.c:350:18: note: Assuming 'chan' is < 
ADS1015_CHANNELS
           if (chan < 0 || chan >= ADS1015_CHANNELS)
                           ^~~~~~~~~~~~~~~~~~~~~~~~
   drivers/iio/adc/ti-ads1015.c:350:2: note: Taking false branch
           if (chan < 0 || chan >= ADS1015_CHANNELS)
           ^
   drivers/iio/adc/ti-ads1015.c:354:6: note: Assuming 'ret' is not equal to 0
           if (ret)
               ^~~
   drivers/iio/adc/ti-ads1015.c:354:2: note: Taking true branch
           if (ret)
           ^
   drivers/iio/adc/ti-ads1015.c:355:3: note: Returning without writing to '*val'
                   return ret;
                   ^
   drivers/iio/adc/ti-ads1015.c:408:8: note: Returning from 
'ads1015_get_adc_result'
           ret = ads1015_get_adc_result(data, chan, &res);
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/iio/adc/ti-ads1015.c:409:6: note: Assuming 'ret' is >= 0
           if (ret < 0) {
               ^~~~~~~
   drivers/iio/adc/ti-ads1015.c:409:2: note: Taking false branch
           if (ret < 0) {
           ^
   drivers/iio/adc/ti-ads1015.c:414:12: note: Assigned value is garbage or 
undefined
           scan.chan = res;
                     ^ ~~~
   Suppressed 8 warnings (7 in non-user code, 1 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use 
-system-headers to display errors from system headers as well.
   6 warnings generated.
   Suppressed 6 warnings (6 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use 
-system-headers to display errors from system headers as well.
   5 warnings generated.
   Suppressed 5 warnings (5 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use 
-system-headers to display errors from system headers as well.
   5 warnings generated.
   Suppressed 5 warnings (5 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use 
-system-headers to display errors from system headers as well.
   8 warnings generated.
   Suppressed 8 warnings (7 in non-user code, 1 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use 
-system-headers to display errors from system headers as well.
   5 warnings generated.
   Suppressed 5 warnings (5 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use 
-system-headers to display errors from system headers as well.
   12 warnings generated.
   drivers/media/usb/uvc/uvc_video.c:429:24: warning: Assigned value is garbage 
or undefined [clang-analyzer-core.uninitialized.Assign]
                   probe->wKeyFrameRate = probe_min.wKeyFrameRate;
                                        ^ ~~~~~~~~~~~~~~~~~~~~~~~
   drivers/media/usb/uvc/uvc_video.c:393:6: note: Assuming 'ret' is >= 0
           if (ret < 0)
               ^~~~~~~
   drivers/media/usb/uvc/uvc_video.c:393:2: note: Taking false branch
           if (ret < 0)
           ^
   drivers/media/usb/uvc/uvc_video.c:397:6: note: Assuming the condition is 
false
           if (!(stream->dev->quirks & UVC_QUIRK_PROBE_MINMAX)) {
               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/media/usb/uvc/uvc_video.c:397:2: note: Taking false branch
           if (!(stream->dev->quirks & UVC_QUIRK_PROBE_MINMAX)) {
           ^
   drivers/media/usb/uvc/uvc_video.c:408:2: note: Loop condition is true.  
Entering loop body
           for (i = 0; i < 2; ++i) {
           ^
   drivers/media/usb/uvc/uvc_video.c:410:7: note: Assuming 'ret' is >= 0
                   if (ret < 0)
                       ^~~~~~~
   drivers/media/usb/uvc/uvc_video.c:410:3: note: Taking false branch
                   if (ret < 0)
                   ^
   drivers/media/usb/uvc/uvc_video.c:413:7: note: Assuming 'ret' is >= 0
                   if (ret < 0)
                       ^~~~~~~
   drivers/media/usb/uvc/uvc_video.c:413:3: note: Taking false branch
                   if (ret < 0)
                   ^
   drivers/media/usb/uvc/uvc_video.c:416:7: note: Assuming field 
'num_altsetting' is not equal to 1
                   if (stream->intf->num_altsetting == 1)
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/media/usb/uvc/uvc_video.c:416:3: note: Taking false branch
                   if (stream->intf->num_altsetting == 1)
                   ^
   drivers/media/usb/uvc/uvc_video.c:420:7: note: Assuming 'bandwidth' is > 
field 'maxpsize'
                   if (bandwidth <= stream->maxpsize)
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/media/usb/uvc/uvc_video.c:420:3: note: Taking false branch
                   if (bandwidth <= stream->maxpsize)
                   ^
   drivers/media/usb/uvc/uvc_video.c:423:7: note: Assuming the condition is 
false
                   if (stream->dev->quirks & UVC_QUIRK_PROBE_MINMAX) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/media/usb/uvc/uvc_video.c:423:3: note: Taking false branch
                   if (stream->dev->quirks & UVC_QUIRK_PROBE_MINMAX) {
                   ^
   drivers/media/usb/uvc/uvc_video.c:429:24: note: Assigned value is garbage or 
undefined
                   probe->wKeyFrameRate = probe_min.wKeyFrameRate;
                                        ^ ~~~~~~~~~~~~~~~~~~~~~~~
>> drivers/media/usb/uvc/uvc_video.c:1354:42: warning: Access to field 
>> 'bytesused' results in a dereference of a null pointer (loaded from variable 
>> 'buf') [clang-analyzer-core.NullDereference]
           if (stream->ctrl.dwMaxVideoFrameSize != buf->bytesused &&
                                                   ^
   drivers/media/usb/uvc/uvc_video.c:1393:14: note: Assuming 'i' is < field 
'number_of_packets'
           for (i = 0; i < urb->number_of_packets; ++i) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/media/usb/uvc/uvc_video.c:1393:2: note: Loop condition is true.  
Entering loop body
           for (i = 0; i < urb->number_of_packets; ++i) {
           ^
   drivers/media/usb/uvc/uvc_video.c:1394:7: note: Assuming field 'status' is 
>= 0
                   if (urb->iso_frame_desc[i].status < 0) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/media/usb/uvc/uvc_video.c:1394:3: note: Taking false branch
                   if (urb->iso_frame_desc[i].status < 0) {
                   ^
   drivers/media/usb/uvc/uvc_video.c:1409:4: note: Taking true branch
                           if (ret == -EAGAIN)
                           ^
   drivers/media/usb/uvc/uvc_video.c:1406:3: note: Loop condition is true. 
Execution continues on line 1407
                   do {
                   ^
   drivers/media/usb/uvc/uvc_video.c:1409:4: note: Taking false branch
                           if (ret == -EAGAIN)
                           ^
   drivers/media/usb/uvc/uvc_video.c:1406:3: note: Loop condition is false.  
Exiting loop
                   do {
                   ^
   drivers/media/usb/uvc/uvc_video.c:1413:7: note: 'ret' is < 0
                   if (ret < 0)
                       ^~~
   drivers/media/usb/uvc/uvc_video.c:1413:3: note: Taking true branch
                   if (ret < 0)
                   ^
   drivers/media/usb/uvc/uvc_video.c:1414:4: note:  Execution continues on line 
1393
                           continue;
                           ^
   drivers/media/usb/uvc/uvc_video.c:1393:14: note: Assuming 'i' is < field 
'number_of_packets'
           for (i = 0; i < urb->number_of_packets; ++i) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/media/usb/uvc/uvc_video.c:1393:2: note: Loop condition is true.  
Entering loop body
           for (i = 0; i < urb->number_of_packets; ++i) {
           ^
   drivers/media/usb/uvc/uvc_video.c:1394:7: note: Assuming field 'status' is 
>= 0
                   if (urb->iso_frame_desc[i].status < 0) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/media/usb/uvc/uvc_video.c:1394:3: note: Taking false branch
                   if (urb->iso_frame_desc[i].status < 0) {
                   ^
   drivers/media/usb/uvc/uvc_video.c:1409:8: note: Assuming the condition is 
true
                           if (ret == -EAGAIN)
                               ^~~~~~~~~~~~~~
   drivers/media/usb/uvc/uvc_video.c:1409:4: note: Taking true branch
                           if (ret == -EAGAIN)
                           ^
   drivers/media/usb/uvc/uvc_video.c:1410:5: note: Calling 
'uvc_video_next_buffers'
                                   uvc_video_next_buffers(stream, &buf, 
&meta_buf);
                                   
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/media/usb/uvc/uvc_video.c:1366:36: note: Passing null pointer value 
via 2nd parameter 'buf'
           uvc_video_validate_buffer(stream, *video_buf);
                                             ^~~~~~~~~~
   drivers/media/usb/uvc/uvc_video.c:1366:2: note: Calling 
'uvc_video_validate_buffer'
           uvc_video_validate_buffer(stream, *video_buf);
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/media/usb/uvc/uvc_video.c:1354:42: note: Access to field 'bytesused' 
results in a dereference of a null pointer (loaded from variable 'buf')
           if (stream->ctrl.dwMaxVideoFrameSize != buf->bytesused &&
                                                   ^~~
   drivers/media/usb/uvc/uvc_video.c:2108:6: warning: Access to field 'nframes' 
results in a dereference of a null pointer (loaded from variable 'format') 
[clang-analyzer-core.NullDereference]
           if (format->nframes == 0) {
               ^~~~~~
   drivers/media/usb/uvc/uvc_video.c:2061:2: note: 'format' initialized to a 
null pointer value
           struct uvc_format *format = NULL;
           ^~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/media/usb/uvc/uvc_video.c:2067:6: note: Assuming field 'nformats' is 
not equal to 0
           if (stream->nformats == 0) {
               ^~~~~~~~~~~~~~~~~~~~~
   drivers/media/usb/uvc/uvc_video.c:2067:2: note: Taking false branch
           if (stream->nformats == 0) {
           ^
   drivers/media/usb/uvc/uvc_video.c:2087:2: note: Taking false branch
           if (uvc_get_video_ctrl(stream, probe, 1, UVC_GET_DEF) == 0)
           ^
   drivers/media/usb/uvc/uvc_video.c:2096:6: note: Assuming 'ret' is >= 0
           if (ret < 0)
               ^~~~~~~
   drivers/media/usb/uvc/uvc_video.c:2096:2: note: Taking false branch
           if (ret < 0)
           ^
   drivers/media/usb/uvc/uvc_video.c:2102:29: note: Assuming 'i' is <= 0
           for (i = stream->nformats; i > 0; --i) {
                                      ^~~~~
   drivers/media/usb/uvc/uvc_video.c:2102:2: note: Loop condition is false. 
Execution continues on line 2108
           for (i = stream->nformats; i > 0; --i) {
           ^
   drivers/media/usb/uvc/uvc_video.c:2108:6: note: Access to field 'nframes' 
results in a dereference of a null pointer (loaded from variable 'format')
           if (format->nframes == 0) {
               ^~~~~~
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use 
-system-headers to display errors from system headers as well.
   5 warnings generated.
   Suppressed 5 warnings (5 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use 
-system-headers to display errors from system headers as well.

vim +2153 drivers/usb/host/oxu210hp-hcd.c

b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2134  
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2135        /* stop async schedule 
right now? */
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2136        if (unlikely(qh == 
oxu->async)) {
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2137                /* can't get 
here without STS_ASS set */
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2138                if 
(oxu_to_hcd(oxu)->state != HC_STATE_HALT
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2139                                
&& !oxu->reclaim) {
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2140                        /* ... 
and CMD_IAAD clear */
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2141                        
writel(cmd & ~CMD_ASE, &oxu->regs->command);
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2142                        wmb();
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2143                        /* 
handshake later, if we need to */
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2144                        
timer_action_done(oxu, TIMER_ASYNC_OFF);
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2145                }
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2146                return;
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2147        }
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2148  
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2149        qh->qh_state = 
QH_STATE_UNLINK;
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2150        oxu->reclaim = qh = 
qh_get(qh);
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2151  
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2152        prev = oxu->async;
b92a78e582b1a4 Rodolfo Giometti 2008-10-23 @2153        while (prev->qh_next.qh 
!= qh)
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2154                prev = 
prev->qh_next.qh;
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2155  
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2156        prev->hw_next = 
qh->hw_next;
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2157        prev->qh_next = 
qh->qh_next;
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2158        wmb();
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2159  
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2160        if 
(unlikely(oxu_to_hcd(oxu)->state == HC_STATE_HALT)) {
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2161                /* if 
(unlikely(qh->reclaim != 0))
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2162                 *      this 
will recurse, probably not much
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2163                 */
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2164                
end_unlink_async(oxu);
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2165                return;
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2166        }
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2167  
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2168        oxu->reclaim_ready = 0;
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2169        cmd |= CMD_IAAD;
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2170        writel(cmd, 
&oxu->regs->command);
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2171        (void) 
readl(&oxu->regs->command);
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2172        timer_action(oxu, 
TIMER_IAA_WATCHDOG);
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2173  }
b92a78e582b1a4 Rodolfo Giometti 2008-10-23  2174  

:::::: The code at line 2153 was first introduced by commit
:::::: b92a78e582b1a45649143dc86e526f5824092478 usb host: Oxford OXU210HP HCD 
driver.

:::::: TO: Rodolfo Giometti <[email protected]>
:::::: CC: Greg Kroah-Hartman <[email protected]>

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]

Attachment: .config.gz
Description: application/gzip

_______________________________________________
kbuild mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to