CC: [email protected] CC: [email protected] CC: Linux Memory Management List <[email protected]> TO: Chris Down <[email protected]> CC: Petr Mladek <[email protected]>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master head: 86ed57fd8c93fdfaabb4f58e78455180fa7d8a84 commit: 337015573718b161891a3473d25f59273f2e626b [1545/9522] printk: Userspace format indexing support :::::: branch date: 35 hours ago :::::: commit date: 5 weeks ago config: x86_64-randconfig-c001-20210813 (attached as .config) compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 62df4df41c939205b2dc0a2a3bfb75b8c1ed74fa) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=337015573718b161891a3473d25f59273f2e626b git remote add linux-next https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git git fetch --no-tags linux-next master git checkout 337015573718b161891a3473d25f59273f2e626b # save the attached .config to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=x86_64 clang-analyzer If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <[email protected]> clang-analyzer warnings: (new ones prefixed by >>) if (--dev_dax->nr_range == 0) { ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/dax/bus.c:383:2: note: Taking true branch if (--dev_dax->nr_range == 0) { ^ drivers/dax/bus.c:385:3: note: Null pointer value stored to field 'ranges' dev_dax->ranges = NULL; ^~~~~~~~~~~~~~~~~~~~~~ drivers/dax/bus.c:392:3: note: Returning from 'trim_dev_dax_range' trim_dev_dax_range(dev_dax); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/dax/bus.c:391:2: note: Loop condition is true. Entering loop body while (dev_dax->nr_range) ^ drivers/dax/bus.c:392:3: note: Calling 'trim_dev_dax_range' trim_dev_dax_range(dev_dax); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/dax/bus.c:374:2: note: 'range' initialized to a null pointer value struct range *range = &dev_dax->ranges[i].range; ^~~~~~~~~~~~~~~~~~~ drivers/dax/bus.c:378:2: note: Taking false branch dev_dbg(&dev_dax->dev, "delete range[%d]: %#llx:%#llx\n", i, ^ include/linux/dev_printk.h:130:2: note: expanded from macro 'dev_dbg' if (0) \ ^ drivers/dax/bus.c:382:37: note: Access to field 'start' results in a dereference of a null pointer (loaded from variable 'range') __release_region(&dax_region->res, range->start, range_len(range)); ^~~~~ drivers/dax/bus.c:820:7: warning: Value stored to 'is_shrink' during its initialization is never read [clang-analyzer-deadcode.DeadStores] bool is_shrink = resource_size(res) > size; ^~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/dax/bus.c:820:7: note: Value stored to 'is_shrink' during its initialization is never read bool is_shrink = resource_size(res) > size; ^~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/dax/bus.c:1109:17: warning: Value stored to 'dev' during its initialization is never read [clang-analyzer-deadcode.DeadStores] struct device *dev = &dev_dax->dev; ^~~ ~~~~~~~~~~~~~ drivers/dax/bus.c:1109:17: note: Value stored to 'dev' during its initialization is never read struct device *dev = &dev_dax->dev; ^~~ ~~~~~~~~~~~~~ Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 6 warnings generated. Suppressed 6 warnings (6 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 6 warnings generated. Suppressed 6 warnings (6 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 6 warnings generated. fs/binfmt_elf.c:1293:3: warning: Value stored to 'error' is never read [clang-analyzer-deadcode.DeadStores] error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC, ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/binfmt_elf.c:1293:3: note: Value stored to 'error' is never read error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC, ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 6 warnings generated. Suppressed 6 warnings (6 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 6 warnings generated. Suppressed 6 warnings (6 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 9 warnings generated. fs/jffs2/write.c:154:5: warning: Value stored to 'flash_ofs' is never read [clang-analyzer-deadcode.DeadStores] flash_ofs = write_ofs(c); ^ fs/jffs2/write.c:154:5: note: Value stored to 'flash_ofs' is never read fs/jffs2/write.c:306:5: warning: Value stored to 'flash_ofs' is never read [clang-analyzer-deadcode.DeadStores] flash_ofs = write_ofs(c); ^ fs/jffs2/write.c:306:5: note: Value stored to 'flash_ofs' is never read fs/jffs2/write.c:603:3: warning: Value stored to 'fd' is never read [clang-analyzer-deadcode.DeadStores] fd = dir_f->dents; ^ ~~~~~~~~~~~~ fs/jffs2/write.c:603:3: note: Value stored to 'fd' is never read fd = dir_f->dents; ^ ~~~~~~~~~~~~ Suppressed 6 warnings (6 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 7 warnings generated. fs/jffs2/scan.c:457:2: warning: Value stored to 'ofs' is never read [clang-analyzer-deadcode.DeadStores] ofs = jeb->offset; ^ ~~~~~~~~~~~ fs/jffs2/scan.c:457:2: note: Value stored to 'ofs' is never read ofs = jeb->offset; ^ ~~~~~~~~~~~ Suppressed 6 warnings (6 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 7 warnings generated. >> fs/jffs2/gc.c:846:3: warning: Argument to kfree() is the address of the >> local variable 'dev', which is not memory allocated by malloc() >> [clang-analyzer-unix.Malloc] kfree(mdata); ^ fs/jffs2/gc.c:134:6: note: Assuming the condition is false if (mutex_lock_interruptible(&c->alloc_sem)) ^ include/linux/mutex.h:166:40: note: expanded from macro 'mutex_lock_interruptible' #define mutex_lock_interruptible(lock) mutex_lock_interruptible_nested(lock, 0) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/jffs2/gc.c:134:2: note: Taking false branch if (mutex_lock_interruptible(&c->alloc_sem)) ^ fs/jffs2/gc.c:138:2: note: Loop condition is true. Entering loop body for (;;) { ^ fs/jffs2/gc.c:144:7: note: Assuming field 'unchecked_size' is 0 if (!c->unchecked_size) ^~~~~~~~~~~~~~~~~~ fs/jffs2/gc.c:144:3: note: Taking true branch if (!c->unchecked_size) ^ fs/jffs2/gc.c:145:4: note: Execution continues on line 248 break; ^ fs/jffs2/gc.c:248:6: note: Assuming the condition is false if (!list_empty(&c->erase_complete_list) || ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/jffs2/gc.c:248:6: note: Left side of '||' is false fs/jffs2/gc.c:249:6: note: Assuming the condition is false !list_empty(&c->erase_pending_list)) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/jffs2/gc.c:248:2: note: Taking false branch if (!list_empty(&c->erase_complete_list) || ^ fs/jffs2/gc.c:264:6: note: Assuming 'jeb' is non-null if (!jeb) ^~~~ fs/jffs2/gc.c:264:2: note: Taking false branch if (!jeb) ^ fs/jffs2/gc.c:267:7: note: 'jeb' is non-null if (!jeb) { ^~~ fs/jffs2/gc.c:267:2: note: Taking false branch if (!jeb) { ^ fs/jffs2/gc.c:280:2: note: 0 is < 1 jffs2_dbg(1, "GC from block %08x, used_size %08x, dirty_size %08x, free_size %08x\n", ^ fs/jffs2/debug.h:69:6: note: expanded from macro 'jffs2_dbg' if (CONFIG_JFFS2_FS_DEBUG >= level) \ ^~~~~~~~~~~~~~~~~~~~~ ./include/generated/autoconf.h:853:31: note: expanded from macro 'CONFIG_JFFS2_FS_DEBUG' #define CONFIG_JFFS2_FS_DEBUG 0 ^ fs/jffs2/gc.c:280:2: note: Taking false branch jffs2_dbg(1, "GC from block %08x, used_size %08x, dirty_size %08x, free_size %08x\n", ^ fs/jffs2/debug.h:69:2: note: expanded from macro 'jffs2_dbg' if (CONFIG_JFFS2_FS_DEBUG >= level) \ ^ fs/jffs2/gc.c:280:2: note: Loop condition is false. Exiting loop jffs2_dbg(1, "GC from block %08x, used_size %08x, dirty_size %08x, free_size %08x\n", ^ fs/jffs2/debug.h:67:37: note: expanded from macro 'jffs2_dbg' #define jffs2_dbg(level, fmt, ...) \ ^ fs/jffs2/gc.c:285:6: note: Assuming field 'used_size' is not equal to 0 if (!jeb->used_size) { ^~~~~~~~~~~~~~~ fs/jffs2/gc.c:285:2: note: Taking false branch if (!jeb->used_size) { ^ fs/jffs2/gc.c:293:8: note: Assuming the condition is false while(ref_obsolete(raw)) { ^ fs/jffs2/nodelist.h:138:28: note: expanded from macro 'ref_obsolete' #define ref_obsolete(ref) (((ref)->flash_offset & 3) == REF_OBSOLETE) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/jffs2/gc.c:293:2: note: Loop condition is false. Execution continues on line 308 while(ref_obsolete(raw)) { ^ fs/jffs2/gc.c:310:2: note: 0 is < 1 jffs2_dbg(1, "Going to garbage collect node at 0x%08x\n", ^ fs/jffs2/debug.h:69:6: note: expanded from macro 'jffs2_dbg' if (CONFIG_JFFS2_FS_DEBUG >= level) \ ^~~~~~~~~~~~~~~~~~~~~ ./include/generated/autoconf.h:853:31: note: expanded from macro 'CONFIG_JFFS2_FS_DEBUG' #define CONFIG_JFFS2_FS_DEBUG 0 ^ fs/jffs2/gc.c:310:2: note: Taking false branch jffs2_dbg(1, "Going to garbage collect node at 0x%08x\n", ^ fs/jffs2/debug.h:69:2: note: expanded from macro 'jffs2_dbg' if (CONFIG_JFFS2_FS_DEBUG >= level) \ ^ fs/jffs2/gc.c:310:2: note: Loop condition is false. Exiting loop jffs2_dbg(1, "Going to garbage collect node at 0x%08x\n", ^ fs/jffs2/debug.h:67:37: note: expanded from macro 'jffs2_dbg' vim +/dev +846 fs/jffs2/gc.c ^1da177e4c3f41 Linus Torvalds 2005-04-16 757 ^1da177e4c3f41 Linus Torvalds 2005-04-16 758 static int jffs2_garbage_collect_metadata(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb, ^1da177e4c3f41 Linus Torvalds 2005-04-16 759 struct jffs2_inode_info *f, struct jffs2_full_dnode *fn) ^1da177e4c3f41 Linus Torvalds 2005-04-16 760 { ^1da177e4c3f41 Linus Torvalds 2005-04-16 761 struct jffs2_full_dnode *new_fn; ^1da177e4c3f41 Linus Torvalds 2005-04-16 762 struct jffs2_raw_inode ri; 8557fd51c22e4c Artem B. Bityuckiy 2005-04-09 763 struct jffs2_node_frag *last_frag; aef9ab47841af4 David Woodhouse 2006-05-19 764 union jffs2_device_node dev; 2e16cfca6e17ae David Woodhouse 2009-12-16 765 char *mdata = NULL; 2e16cfca6e17ae David Woodhouse 2009-12-16 766 int mdatalen = 0; 9fe4854cd1f602 David Woodhouse 2006-05-23 767 uint32_t alloclen, ilen; ^1da177e4c3f41 Linus Torvalds 2005-04-16 768 int ret; ^1da177e4c3f41 Linus Torvalds 2005-04-16 769 ^1da177e4c3f41 Linus Torvalds 2005-04-16 770 if (S_ISBLK(JFFS2_F_I_MODE(f)) || ^1da177e4c3f41 Linus Torvalds 2005-04-16 771 S_ISCHR(JFFS2_F_I_MODE(f)) ) { ^1da177e4c3f41 Linus Torvalds 2005-04-16 772 /* For these, we don't actually need to read the old node */ aef9ab47841af4 David Woodhouse 2006-05-19 773 mdatalen = jffs2_encode_dev(&dev, JFFS2_F_I_RDEV(f)); ^1da177e4c3f41 Linus Torvalds 2005-04-16 774 mdata = (char *)&dev; 9c261b33a9c417 Joe Perches 2012-02-15 775 jffs2_dbg(1, "%s(): Writing %d bytes of kdev_t\n", 9c261b33a9c417 Joe Perches 2012-02-15 776 __func__, mdatalen); ^1da177e4c3f41 Linus Torvalds 2005-04-16 777 } else if (S_ISLNK(JFFS2_F_I_MODE(f))) { ^1da177e4c3f41 Linus Torvalds 2005-04-16 778 mdatalen = fn->size; ^1da177e4c3f41 Linus Torvalds 2005-04-16 779 mdata = kmalloc(fn->size, GFP_KERNEL); ^1da177e4c3f41 Linus Torvalds 2005-04-16 780 if (!mdata) { da320f055a8818 Joe Perches 2012-02-15 781 pr_warn("kmalloc of mdata failed in jffs2_garbage_collect_metadata()\n"); ^1da177e4c3f41 Linus Torvalds 2005-04-16 782 return -ENOMEM; ^1da177e4c3f41 Linus Torvalds 2005-04-16 783 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 784 ret = jffs2_read_dnode(c, f, fn, mdata, 0, mdatalen); ^1da177e4c3f41 Linus Torvalds 2005-04-16 785 if (ret) { da320f055a8818 Joe Perches 2012-02-15 786 pr_warn("read of old metadata failed in jffs2_garbage_collect_metadata(): %d\n", da320f055a8818 Joe Perches 2012-02-15 787 ret); ^1da177e4c3f41 Linus Torvalds 2005-04-16 788 kfree(mdata); ^1da177e4c3f41 Linus Torvalds 2005-04-16 789 return ret; ^1da177e4c3f41 Linus Torvalds 2005-04-16 790 } 9c261b33a9c417 Joe Perches 2012-02-15 791 jffs2_dbg(1, "%s(): Writing %d bites of symlink target\n", 9c261b33a9c417 Joe Perches 2012-02-15 792 __func__, mdatalen); ^1da177e4c3f41 Linus Torvalds 2005-04-16 793 ^1da177e4c3f41 Linus Torvalds 2005-04-16 794 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 795 9fe4854cd1f602 David Woodhouse 2006-05-23 796 ret = jffs2_reserve_space_gc(c, sizeof(ri) + mdatalen, &alloclen, e631ddba588783 Ferenc Havasi 2005-09-07 797 JFFS2_SUMMARY_INODE_SIZE); ^1da177e4c3f41 Linus Torvalds 2005-04-16 798 if (ret) { da320f055a8818 Joe Perches 2012-02-15 799 pr_warn("jffs2_reserve_space_gc of %zd bytes for garbage_collect_metadata failed: %d\n", ^1da177e4c3f41 Linus Torvalds 2005-04-16 800 sizeof(ri) + mdatalen, ret); ^1da177e4c3f41 Linus Torvalds 2005-04-16 801 goto out; ^1da177e4c3f41 Linus Torvalds 2005-04-16 802 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 803 8557fd51c22e4c Artem B. Bityuckiy 2005-04-09 804 last_frag = frag_last(&f->fragtree); 8557fd51c22e4c Artem B. Bityuckiy 2005-04-09 805 if (last_frag) 8557fd51c22e4c Artem B. Bityuckiy 2005-04-09 806 /* Fetch the inode length from the fragtree rather then 8557fd51c22e4c Artem B. Bityuckiy 2005-04-09 807 * from i_size since i_size may have not been updated yet */ 8557fd51c22e4c Artem B. Bityuckiy 2005-04-09 808 ilen = last_frag->ofs + last_frag->size; 8557fd51c22e4c Artem B. Bityuckiy 2005-04-09 809 else 8557fd51c22e4c Artem B. Bityuckiy 2005-04-09 810 ilen = JFFS2_F_I_SIZE(f); 8557fd51c22e4c Artem B. Bityuckiy 2005-04-09 811 ^1da177e4c3f41 Linus Torvalds 2005-04-16 812 memset(&ri, 0, sizeof(ri)); ^1da177e4c3f41 Linus Torvalds 2005-04-16 813 ri.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK); ^1da177e4c3f41 Linus Torvalds 2005-04-16 814 ri.nodetype = cpu_to_je16(JFFS2_NODETYPE_INODE); ^1da177e4c3f41 Linus Torvalds 2005-04-16 815 ri.totlen = cpu_to_je32(sizeof(ri) + mdatalen); ^1da177e4c3f41 Linus Torvalds 2005-04-16 816 ri.hdr_crc = cpu_to_je32(crc32(0, &ri, sizeof(struct jffs2_unknown_node)-4)); ^1da177e4c3f41 Linus Torvalds 2005-04-16 817 ^1da177e4c3f41 Linus Torvalds 2005-04-16 818 ri.ino = cpu_to_je32(f->inocache->ino); ^1da177e4c3f41 Linus Torvalds 2005-04-16 819 ri.version = cpu_to_je32(++f->highest_version); ^1da177e4c3f41 Linus Torvalds 2005-04-16 820 ri.mode = cpu_to_jemode(JFFS2_F_I_MODE(f)); ^1da177e4c3f41 Linus Torvalds 2005-04-16 821 ri.uid = cpu_to_je16(JFFS2_F_I_UID(f)); ^1da177e4c3f41 Linus Torvalds 2005-04-16 822 ri.gid = cpu_to_je16(JFFS2_F_I_GID(f)); 8557fd51c22e4c Artem B. Bityuckiy 2005-04-09 823 ri.isize = cpu_to_je32(ilen); ^1da177e4c3f41 Linus Torvalds 2005-04-16 824 ri.atime = cpu_to_je32(JFFS2_F_I_ATIME(f)); ^1da177e4c3f41 Linus Torvalds 2005-04-16 825 ri.ctime = cpu_to_je32(JFFS2_F_I_CTIME(f)); ^1da177e4c3f41 Linus Torvalds 2005-04-16 826 ri.mtime = cpu_to_je32(JFFS2_F_I_MTIME(f)); ^1da177e4c3f41 Linus Torvalds 2005-04-16 827 ri.offset = cpu_to_je32(0); ^1da177e4c3f41 Linus Torvalds 2005-04-16 828 ri.csize = cpu_to_je32(mdatalen); ^1da177e4c3f41 Linus Torvalds 2005-04-16 829 ri.dsize = cpu_to_je32(mdatalen); ^1da177e4c3f41 Linus Torvalds 2005-04-16 830 ri.compr = JFFS2_COMPR_NONE; ^1da177e4c3f41 Linus Torvalds 2005-04-16 831 ri.node_crc = cpu_to_je32(crc32(0, &ri, sizeof(ri)-8)); ^1da177e4c3f41 Linus Torvalds 2005-04-16 832 ri.data_crc = cpu_to_je32(crc32(0, mdata, mdatalen)); ^1da177e4c3f41 Linus Torvalds 2005-04-16 833 9fe4854cd1f602 David Woodhouse 2006-05-23 834 new_fn = jffs2_write_dnode(c, f, &ri, mdata, mdatalen, ALLOC_GC); ^1da177e4c3f41 Linus Torvalds 2005-04-16 835 ^1da177e4c3f41 Linus Torvalds 2005-04-16 836 if (IS_ERR(new_fn)) { da320f055a8818 Joe Perches 2012-02-15 837 pr_warn("Error writing new dnode: %ld\n", PTR_ERR(new_fn)); ^1da177e4c3f41 Linus Torvalds 2005-04-16 838 ret = PTR_ERR(new_fn); ^1da177e4c3f41 Linus Torvalds 2005-04-16 839 goto out; ^1da177e4c3f41 Linus Torvalds 2005-04-16 840 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 841 jffs2_mark_node_obsolete(c, fn->raw); ^1da177e4c3f41 Linus Torvalds 2005-04-16 842 jffs2_free_full_dnode(fn); ^1da177e4c3f41 Linus Torvalds 2005-04-16 843 f->metadata = new_fn; ^1da177e4c3f41 Linus Torvalds 2005-04-16 844 out: ^1da177e4c3f41 Linus Torvalds 2005-04-16 845 if (S_ISLNK(JFFS2_F_I_MODE(f))) ^1da177e4c3f41 Linus Torvalds 2005-04-16 @846 kfree(mdata); ^1da177e4c3f41 Linus Torvalds 2005-04-16 847 return ret; ^1da177e4c3f41 Linus Torvalds 2005-04-16 848 } ^1da177e4c3f41 Linus Torvalds 2005-04-16 849 :::::: The code at line 846 was first introduced by commit :::::: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Linux-2.6.12-rc2 :::::: TO: Linus Torvalds <[email protected]> :::::: CC: Linus Torvalds <[email protected]> --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/[email protected]
.config.gz
Description: application/gzip
_______________________________________________ kbuild mailing list -- [email protected] To unsubscribe send an email to [email protected]
