CC: [email protected]
CC: [email protected]
CC: [email protected]
TO: Jakub Kicinski <[email protected]>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 
master
head:   1e0083bd0777e4a418a6710d9ee04b979cdbe5cc
commit: 719c571970109b0d0af24745d31b202affc9365f [14/41] net: make 
napi_disable() symmetric with enable
:::::: branch date: 33 hours ago
:::::: commit date: 3 days ago
config: x86_64-randconfig-c007-20210927 (attached as .config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 
dc6e8dfdfe7efecfda318d43a06fae18b40eb498)
reproduce (this is a W=1 build):
        wget 
https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O 
~/bin/make.cross
        chmod +x ~/bin/make.cross
        # 
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git/commit/?id=719c571970109b0d0af24745d31b202affc9365f
        git remote add net-next 
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
        git fetch --no-tags net-next master
        git checkout 719c571970109b0d0af24745d31b202affc9365f
        # save the attached .config to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=x86_64 
clang-analyzer 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <[email protected]>


clang-analyzer warnings: (new ones prefixed by >>)
           ^
   include/linux/netdevice.h:3048:2: note: Calling 'skb_gro_frag0_invalidate'
           skb_gro_frag0_invalidate(skb);
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/netdevice.h:3038:2: note: Null pointer value stored to field 
'frag0'
           NAPI_GRO_CB(skb)->frag0 = NULL;
           ^
   include/linux/netdevice.h:2590:26: note: expanded from macro 'NAPI_GRO_CB'
   #define NAPI_GRO_CB(skb) ((struct napi_gro_cb *)(skb)->cb)
                            ^
   include/linux/netdevice.h:3048:2: note: Returning from 
'skb_gro_frag0_invalidate'
           skb_gro_frag0_invalidate(skb);
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   net/core/dev.c:6301:9: note: Returning from 'skb_gro_header_slow'
                   eth = skb_gro_header_slow(skb, hlen, 0);
                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   net/core/dev.c:6302:16: note: Assuming 'eth' is non-null
                   if (unlikely(!eth)) {
                                ^
   include/linux/compiler.h:78:42: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                               ^
   net/core/dev.c:6302:3: note: Taking false branch
                   if (unlikely(!eth)) {
                   ^
   net/core/dev.c:6314:2: note: Calling '__skb_pull'
           __skb_pull(skb, hlen);
           ^~~~~~~~~~~~~~~~~~~~~
   include/linux/skbuff.h:2329:9: note: Assuming field 'len' is >= field 
'data_len'
           BUG_ON(skb->len < skb->data_len);
                  ^
   include/asm-generic/bug.h:65:45: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                               ^~~~~~~~~
   include/linux/compiler.h:78:42: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                               ^
   include/linux/skbuff.h:2329:2: note: Taking false branch
           BUG_ON(skb->len < skb->data_len);
           ^
   include/asm-generic/bug.h:65:32: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                  ^
   include/linux/skbuff.h:2329:2: note: Loop condition is false.  Exiting loop
           BUG_ON(skb->len < skb->data_len);
           ^
   include/asm-generic/bug.h:65:27: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                             ^
   net/core/dev.c:6314:2: note: Returning from '__skb_pull'
           __skb_pull(skb, hlen);
           ^~~~~~~~~~~~~~~~~~~~~
   net/core/dev.c:6329:24: note: Returning from 'napi_frags_skb'
           struct sk_buff *skb = napi_frags_skb(napi);
                                 ^~~~~~~~~~~~~~~~~~~~
   net/core/dev.c:6333:37: note: Calling 'dev_gro_receive'
           ret = napi_frags_finish(napi, skb, dev_gro_receive(napi, skb));
                                              ^~~~~~~~~~~~~~~~~~~~~~~~~~
   net/core/dev.c:6044:2: note: Taking true branch
           if (netif_elide_gro(skb->dev))
           ^
   net/core/dev.c:6045:3: note: Control jumps to line 6138
                   goto normal;
                   ^
   net/core/dev.c:6139:2: note: Control jumps to line 6124
           goto pull;
           ^
   net/core/dev.c:6125:6: note: Assuming 'grow' is > 0
           if (grow > 0)
               ^~~~~~~~
   net/core/dev.c:6125:2: note: Taking true branch
           if (grow > 0)
           ^
   net/core/dev.c:6126:3: note: Calling 'gro_pull_from_frag0'
                   gro_pull_from_frag0(skb, grow);
                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   net/core/dev.c:5996:9: note: Assuming the condition is false
           BUG_ON(skb->end - skb->tail < grow);
                  ^
   include/asm-generic/bug.h:65:45: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                               ^~~~~~~~~
   include/linux/compiler.h:78:42: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                               ^
   net/core/dev.c:5996:2: note: Taking false branch
           BUG_ON(skb->end - skb->tail < grow);
           ^
   include/asm-generic/bug.h:65:32: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                  ^
   net/core/dev.c:5996:2: note: Loop condition is false.  Exiting loop
           BUG_ON(skb->end - skb->tail < grow);
           ^
   include/asm-generic/bug.h:65:27: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                             ^
   net/core/dev.c:5998:2: note: Null pointer passed as 2nd argument to memory 
copy function
           memcpy(skb_tail_pointer(skb), NAPI_GRO_CB(skb)->frag0, grow);
           ^
>> net/core/dev.c:6917:11: warning: Assigned value is garbage or undefined 
>> [clang-analyzer-core.uninitialized.Assign]
           } while (cmpxchg(&n->state, val, new) != val);
                    ^
   include/linux/atomic/atomic-instrumented.h:1790:2: note: expanded from macro 
'cmpxchg'
           arch_cmpxchg(__ai_ptr, __VA_ARGS__); \
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   arch/x86/include/asm/cmpxchg.h:149:2: note: expanded from macro 
'arch_cmpxchg'
           __cmpxchg(ptr, old, new, sizeof(*(ptr)))
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   arch/x86/include/asm/cmpxchg.h:134:2: note: expanded from macro '__cmpxchg'
           __raw_cmpxchg((ptr), (old), (new), (size), LOCK_PREFIX)
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   arch/x86/include/asm/cmpxchg.h:89:2: note: expanded from macro 
'__raw_cmpxchg'
           __typeof__(*(ptr)) __new = (new);                               \
           ^                          ~~~~~
   net/core/dev.c:6903:21: note: 'new' declared without an initial value
           unsigned long val, new;
                              ^~~
   net/core/dev.c:6905:2: note: Loop condition is false.  Exiting loop
           might_sleep();
           ^
   include/linux/kernel.h:132:45: note: expanded from macro 'might_sleep'
           do { __might_sleep(__FILE__, __LINE__, 0); might_resched(); } while 
(0)
                                                      ^
   include/linux/kernel.h:109:26: note: expanded from macro 'might_resched'
   # define might_resched() do { } while (0)
                            ^
   net/core/dev.c:6905:2: note: Loop condition is false.  Exiting loop
           might_sleep();
           ^
   include/linux/kernel.h:132:2: note: expanded from macro 'might_sleep'
           do { __might_sleep(__FILE__, __LINE__, 0); might_resched(); } while 
(0)
           ^
   net/core/dev.c:6909:9: note: Left side of '||' is false
                   val = READ_ONCE(n->state);
                         ^
   include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE'
           compiletime_assert_rwonce_type(x);                              \
           ^
   include/asm-generic/rwonce.h:36:21: note: expanded from macro 
'compiletime_assert_rwonce_type'
           compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long 
long),  \
                              ^
   include/linux/compiler_types.h:290:3: note: expanded from macro 
'__native_word'
           (sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || \
            ^
   net/core/dev.c:6909:9: note: Left side of '||' is false
                   val = READ_ONCE(n->state);
                         ^
   include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE'
           compiletime_assert_rwonce_type(x);                              \
           ^
   include/asm-generic/rwonce.h:36:21: note: expanded from macro 
'compiletime_assert_rwonce_type'
           compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long 
long),  \
                              ^
   include/linux/compiler_types.h:290:3: note: expanded from macro 
'__native_word'
           (sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || \
            ^
   net/core/dev.c:6909:9: note: Left side of '||' is false
                   val = READ_ONCE(n->state);
                         ^
   include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE'
           compiletime_assert_rwonce_type(x);                              \
           ^
   include/asm-generic/rwonce.h:36:21: note: expanded from macro 
'compiletime_assert_rwonce_type'
           compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long 
long),  \
                              ^
   include/linux/compiler_types.h:290:3: note: expanded from macro 
'__native_word'
           (sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || \
            ^
   net/core/dev.c:6909:9: note: Left side of '||' is true
                   val = READ_ONCE(n->state);
                         ^
   include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE'
           compiletime_assert_rwonce_type(x);                              \
           ^
   include/asm-generic/rwonce.h:36:38: note: expanded from macro 
'compiletime_assert_rwonce_type'
           compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long 
long),  \
                                               ^
   net/core/dev.c:6909:9: note: Taking false branch
                   val = READ_ONCE(n->state);
                         ^
   include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE'
           compiletime_assert_rwonce_type(x);                              \
           ^
   include/asm-generic/rwonce.h:36:2: note: expanded from macro 
'compiletime_assert_rwonce_type'
           compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long 
long),  \
           ^
   include/linux/compiler_types.h:322:2: note: expanded from macro 
'compiletime_assert'
           _compiletime_assert(condition, msg, __compiletime_assert_, 
__COUNTER__)
           ^
   include/linux/compiler_types.h:310:2: note: expanded from macro 
'_compiletime_assert'
           __compiletime_assert(condition, msg, prefix, suffix)
           ^
   include/linux/compiler_types.h:302:3: note: expanded from macro 
'__compiletime_assert'
                   if (!(condition))                                       \
                   ^
   net/core/dev.c:6909:9: note: Loop condition is false.  Exiting loop
                   val = READ_ONCE(n->state);
                         ^
   include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE'
           compiletime_assert_rwonce_type(x);                              \

vim +6917 net/core/dev.c

d565b0a1a9b6ee Herbert Xu     2008-12-15  6900  
3b47d30396bae4 Eric Dumazet   2014-11-06  6901  void napi_disable(struct 
napi_struct *n)
3b47d30396bae4 Eric Dumazet   2014-11-06  6902  {
719c571970109b Jakub Kicinski 2021-09-24  6903          unsigned long val, new;
719c571970109b Jakub Kicinski 2021-09-24  6904  
3b47d30396bae4 Eric Dumazet   2014-11-06  6905          might_sleep();
3b47d30396bae4 Eric Dumazet   2014-11-06  6906          
set_bit(NAPI_STATE_DISABLE, &n->state);
3b47d30396bae4 Eric Dumazet   2014-11-06  6907  
719c571970109b Jakub Kicinski 2021-09-24  6908          do {
719c571970109b Jakub Kicinski 2021-09-24  6909                  val = 
READ_ONCE(n->state);
719c571970109b Jakub Kicinski 2021-09-24  6910                  if (val & 
(NAPIF_STATE_SCHED | NAPIF_STATE_NPSVC)) {
719c571970109b Jakub Kicinski 2021-09-24  6911                          
usleep_range(20, 200);
719c571970109b Jakub Kicinski 2021-09-24  6912                          
continue;
719c571970109b Jakub Kicinski 2021-09-24  6913                  }
719c571970109b Jakub Kicinski 2021-09-24  6914  
719c571970109b Jakub Kicinski 2021-09-24  6915                  new = val | 
NAPIF_STATE_SCHED | NAPIF_STATE_NPSVC;
719c571970109b Jakub Kicinski 2021-09-24  6916                  new &= 
~(NAPIF_STATE_THREADED | NAPIF_STATE_PREFER_BUSY_POLL);
719c571970109b Jakub Kicinski 2021-09-24 @6917          } while 
(cmpxchg(&n->state, val, new) != val);
3b47d30396bae4 Eric Dumazet   2014-11-06  6918  
3b47d30396bae4 Eric Dumazet   2014-11-06  6919          
hrtimer_cancel(&n->timer);
3b47d30396bae4 Eric Dumazet   2014-11-06  6920  
3b47d30396bae4 Eric Dumazet   2014-11-06  6921          
clear_bit(NAPI_STATE_DISABLE, &n->state);
3b47d30396bae4 Eric Dumazet   2014-11-06  6922  }
3b47d30396bae4 Eric Dumazet   2014-11-06  6923  EXPORT_SYMBOL(napi_disable);
3b47d30396bae4 Eric Dumazet   2014-11-06  6924  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]

Attachment: .config.gz
Description: application/gzip

_______________________________________________
kbuild mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to