CC: [email protected] CC: [email protected] In-Reply-To: <2eed797ac2605bd068a025486fc0c09c2687e50c.1643435854.git.obj...@gmail.com> References: <2eed797ac2605bd068a025486fc0c09c2687e50c.1643435854.git.obj...@gmail.com> TO: [email protected] TO: [email protected] TO: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected]
Hi, I love your patch! Perhaps something to improve: [auto build test WARNING on bluetooth-next/master] [also build test WARNING on next-20220211] [cannot apply to v5.17-rc3] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch] url: https://github.com/0day-ci/linux/commits/sean-wang-mediatek-com/Bluetooth-mt7921s-support-bluetooth-reset-mechanism/20220129-140313 base: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git master :::::: branch date: 2 weeks ago :::::: commit date: 2 weeks ago config: riscv-randconfig-c006-20220205 (https://download.01.org/0day-ci/archive/20220213/[email protected]/config) compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project dee058c670593b999fec19c458dbbd882ad9de56) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # install riscv cross compiling tool for clang build # apt-get install binutils-riscv64-linux-gnu # https://github.com/0day-ci/linux/commit/33092fd43b74594bae07555a6fdf15133cc8ec54 git remote add linux-review https://github.com/0day-ci/linux git fetch --no-tags linux-review sean-wang-mediatek-com/Bluetooth-mt7921s-support-bluetooth-reset-mechanism/20220129-140313 git checkout 33092fd43b74594bae07555a6fdf15133cc8ec54 # save the config file to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=riscv clang-analyzer If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <[email protected]> clang-analyzer warnings: (new ones prefixed by >>) ^ drivers/mtd/nand/raw/nand_onfi.c:190:7: note: Assuming 'crc' is equal to field 'crc' if (crc == le16_to_cpu(pbuf[i].crc)) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/mtd/nand/raw/nand_onfi.c:190:3: note: Taking true branch if (crc == le16_to_cpu(pbuf[i].crc)) { ^ drivers/mtd/nand/raw/nand_onfi.c:192:4: note: Execution continues on line 196 break; ^ drivers/mtd/nand/raw/nand_onfi.c:196:6: note: 'i' is not equal to ONFI_PARAM_PAGES if (i == ONFI_PARAM_PAGES) { ^ drivers/mtd/nand/raw/nand_onfi.c:196:2: note: Taking false branch if (i == ONFI_PARAM_PAGES) { ^ drivers/mtd/nand/raw/nand_onfi.c:215:6: note: Assuming field 'desc' is null if (chip->manufacturer.desc && chip->manufacturer.desc->ops && ^~~~~~~~~~~~~~~~~~~~~~~ drivers/mtd/nand/raw/nand_onfi.c:215:30: note: Left side of '&&' is false if (chip->manufacturer.desc && chip->manufacturer.desc->ops && ^ drivers/mtd/nand/raw/nand_onfi.c:221:6: note: Assuming the condition is false if (val & ONFI_VERSION_2_3) ^~~~~~~~~~~~~~~~~~~~~~ drivers/mtd/nand/raw/nand_onfi.c:221:2: note: Taking false branch if (val & ONFI_VERSION_2_3) ^ drivers/mtd/nand/raw/nand_onfi.c:223:11: note: Assuming the condition is false else if (val & ONFI_VERSION_2_2) ^~~~~~~~~~~~~~~~~~~~~~ drivers/mtd/nand/raw/nand_onfi.c:223:7: note: Taking false branch else if (val & ONFI_VERSION_2_2) ^ drivers/mtd/nand/raw/nand_onfi.c:225:11: note: Assuming the condition is false else if (val & ONFI_VERSION_2_1) ^~~~~~~~~~~~~~~~~~~~~~ drivers/mtd/nand/raw/nand_onfi.c:225:7: note: Taking false branch else if (val & ONFI_VERSION_2_1) ^ drivers/mtd/nand/raw/nand_onfi.c:227:11: note: Assuming the condition is false else if (val & ONFI_VERSION_2_0) ^~~~~~~~~~~~~~~~~~~~~~ drivers/mtd/nand/raw/nand_onfi.c:227:7: note: Taking false branch else if (val & ONFI_VERSION_2_0) ^ drivers/mtd/nand/raw/nand_onfi.c:229:11: note: Assuming the condition is true else if (val & ONFI_VERSION_1_0) ^~~~~~~~~~~~~~~~~~~~~~ drivers/mtd/nand/raw/nand_onfi.c:229:7: note: Taking true branch else if (val & ONFI_VERSION_1_0) ^ drivers/mtd/nand/raw/nand_onfi.c:232:7: note: 'onfi_version' is 10 if (!onfi_version) { ^~~~~~~~~~~~ drivers/mtd/nand/raw/nand_onfi.c:232:2: note: Taking false branch if (!onfi_version) { ^ drivers/mtd/nand/raw/nand_onfi.c:240:6: note: Assuming field 'model' is non-null if (!chip->parameters.model) { ^~~~~~~~~~~~~~~~~~~~~~~ drivers/mtd/nand/raw/nand_onfi.c:240:2: note: Taking false branch if (!chip->parameters.model) { ^ drivers/mtd/nand/raw/nand_onfi.c:265:5: note: The result of the left shift is undefined because the right operand is negative 1 << (fls(le32_to_cpu(p->blocks_per_lun)) - 1); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Suppressed 3 warnings (3 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 9 warnings generated. Suppressed 9 warnings (2 in non-user code, 7 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 9 warnings generated. Suppressed 9 warnings (2 in non-user code, 7 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 9 warnings generated. Suppressed 9 warnings (2 in non-user code, 7 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 9 warnings generated. Suppressed 9 warnings (2 in non-user code, 7 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 9 warnings generated. Suppressed 9 warnings (2 in non-user code, 7 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 2 warnings generated. Suppressed 2 warnings (2 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 9 warnings generated. Suppressed 9 warnings (2 in non-user code, 7 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 9 warnings generated. Suppressed 9 warnings (2 in non-user code, 7 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 9 warnings generated. Suppressed 9 warnings (2 in non-user code, 7 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 10 warnings generated. Suppressed 10 warnings (3 in non-user code, 7 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 12 warnings generated. >> drivers/bluetooth/btusb.c:2273:3: warning: Value stored to 'hdr' is never >> read [clang-analyzer-deadcode.DeadStores] hdr = (void *)skb->data; ^ ~~~~~~~~~~~~~~~~~ drivers/bluetooth/btusb.c:2273:3: note: Value stored to 'hdr' is never read hdr = (void *)skb->data; ^ ~~~~~~~~~~~~~~~~~ Suppressed 11 warnings (3 in non-user code, 8 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 9 warnings generated. Suppressed 9 warnings (2 in non-user code, 7 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 9 warnings generated. Suppressed 9 warnings (2 in non-user code, 7 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 9 warnings generated. Suppressed 9 warnings (2 in non-user code, 7 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 23 warnings generated. drivers/net/ethernet/qlogic/qed/qed_debug.c:1100:3: warning: Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119 [clang-analyzer-security.insecureAPI.strcpy] strcpy(dump_buf, str); ^~~~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:1100:3: note: Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119 strcpy(dump_buf, str); ^~~~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:1100:3: warning: Null pointer passed as 1st argument to string copy function [clang-analyzer-unix.cstring.NullArg] strcpy(dump_buf, str); ^ drivers/net/ethernet/qlogic/qed/qed_debug.c:5676:6: note: 'status' is equal to DBG_STATUS_OK if (status != DBG_STATUS_OK) ^~~~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:5676:2: note: Taking false branch if (status != DBG_STATUS_OK) ^ drivers/net/ethernet/qlogic/qed/qed_debug.c:5679:42: note: Passing null pointer value via 3rd parameter 'dump_buf' *buf_size = qed_ilt_dump(p_hwfn, p_ptt, NULL, 0, false); ^ include/linux/stddef.h:8:14: note: expanded from macro 'NULL' #define NULL ((void *)0) ^~~~~~~~~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:5679:14: note: Calling 'qed_ilt_dump' *buf_size = qed_ilt_dump(p_hwfn, p_ptt, NULL, 0, false); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:5017:6: note: 'dump' is false if (dump) { ^~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:5017:2: note: Taking false branch if (dump) { ^ drivers/net/ethernet/qlogic/qed/qed_debug.c:5033:6: note: 'continue_dump' is false if (continue_dump) { ^~~~~~~~~~~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:5033:2: note: Taking false branch if (continue_dump) { ^ drivers/net/ethernet/qlogic/qed/qed_debug.c:5064:6: note: 'continue_dump' is false if (continue_dump) { ^~~~~~~~~~~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:5064:2: note: Taking false branch if (continue_dump) { ^ drivers/net/ethernet/qlogic/qed/qed_debug.c:5085:6: note: 'continue_dump' is false if (continue_dump) { ^~~~~~~~~~~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:5085:2: note: Taking false branch if (continue_dump) { ^ drivers/net/ethernet/qlogic/qed/qed_debug.c:5110:6: note: 'continue_dump' is false if (continue_dump) { ^~~~~~~~~~~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:5110:2: note: Taking false branch if (continue_dump) { ^ drivers/net/ethernet/qlogic/qed/qed_debug.c:5135:6: note: 'continue_dump' is false if (continue_dump) { ^~~~~~~~~~~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:5135:2: note: Taking false branch if (continue_dump) { ^ drivers/net/ethernet/qlogic/qed/qed_debug.c:5168:37: note: Passing null pointer value via 2nd parameter 'dump_buf' qed_ilt_dump_pages_section(p_hwfn, dump_buf, &offset, &continue_dump, ^~~~~~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:5168:2: note: Calling 'qed_ilt_dump_pages_section' qed_ilt_dump_pages_section(p_hwfn, dump_buf, &offset, &continue_dump, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:4654:17: note: 'dump_page_ids' is false section_name = dump_page_ids ? "ilt_page_ids" : "ilt_page_mem"; ^~~~~~~~~~~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:4654:17: note: '?' condition is false drivers/net/ethernet/qlogic/qed/qed_debug.c:4668:6: note: Assuming 'continue_dump' is true if ((continue_dump) && ^~~~~~~~~~~~~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:4668:6: note: Left side of '&&' is true drivers/net/ethernet/qlogic/qed/qed_debug.c:4669:7: note: Assuming the condition is false (offset + section_header_and_param_size > buf_size_in_dwords)) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/qlogic/qed/qed_debug.c:4668:2: note: Taking false branch if ((continue_dump) && ^ drivers/net/ethernet/qlogic/qed/qed_debug.c:4675:33: note: Passing null pointer value via 1st parameter 'dump_buf' offset += qed_dump_section_hdr(dump_buf + offset, ^~~~~~~~~~~~~~~~~ vim +/hdr +2273 drivers/bluetooth/btusb.c 5a87679ffd4436 mark-yw.chen 2021-09-01 2248 a1c49c434e1505 Sean Wang 2019-06-02 2249 static void btusb_mtk_wmt_recv(struct urb *urb) a1c49c434e1505 Sean Wang 2019-06-02 2250 { a1c49c434e1505 Sean Wang 2019-06-02 2251 struct hci_dev *hdev = urb->context; a1c49c434e1505 Sean Wang 2019-06-02 2252 struct btusb_data *data = hci_get_drvdata(hdev); a1c49c434e1505 Sean Wang 2019-06-02 2253 struct hci_event_hdr *hdr; a1c49c434e1505 Sean Wang 2019-06-02 2254 struct sk_buff *skb; a1c49c434e1505 Sean Wang 2019-06-02 2255 int err; a1c49c434e1505 Sean Wang 2019-06-02 2256 a1c49c434e1505 Sean Wang 2019-06-02 2257 if (urb->status == 0 && urb->actual_length > 0) { a1c49c434e1505 Sean Wang 2019-06-02 2258 hdev->stat.byte_rx += urb->actual_length; a1c49c434e1505 Sean Wang 2019-06-02 2259 a1c49c434e1505 Sean Wang 2019-06-02 2260 /* WMT event shouldn't be fragmented and the size should be a1c49c434e1505 Sean Wang 2019-06-02 2261 * less than HCI_WMT_MAX_EVENT_SIZE. a1c49c434e1505 Sean Wang 2019-06-02 2262 */ a1c49c434e1505 Sean Wang 2019-06-02 2263 skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC); a1c49c434e1505 Sean Wang 2019-06-02 2264 if (!skb) { a1c49c434e1505 Sean Wang 2019-06-02 2265 hdev->stat.err_rx++; 60c6a63a3d3080 Mark-YW.Chen 2021-10-14 2266 kfree(urb->setup_packet); de71a6cb4bf24d Jupeng Zhong 2021-02-02 2267 return; a1c49c434e1505 Sean Wang 2019-06-02 2268 } a1c49c434e1505 Sean Wang 2019-06-02 2269 a1c49c434e1505 Sean Wang 2019-06-02 2270 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; a1c49c434e1505 Sean Wang 2019-06-02 2271 skb_put_data(skb, urb->transfer_buffer, urb->actual_length); a1c49c434e1505 Sean Wang 2019-06-02 2272 a1c49c434e1505 Sean Wang 2019-06-02 @2273 hdr = (void *)skb->data; a1c49c434e1505 Sean Wang 2019-06-02 2274 a1c49c434e1505 Sean Wang 2019-06-02 2275 /* When someone waits for the WMT event, the skb is being cloned a1c49c434e1505 Sean Wang 2019-06-02 2276 * and being processed the events from there then. a1c49c434e1505 Sean Wang 2019-06-02 2277 */ a1c49c434e1505 Sean Wang 2019-06-02 2278 if (test_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags)) { 22cc6b7a1dbb58 Johan Hovold 2019-11-28 2279 data->evt_skb = skb_clone(skb, GFP_ATOMIC); de71a6cb4bf24d Jupeng Zhong 2021-02-02 2280 if (!data->evt_skb) { de71a6cb4bf24d Jupeng Zhong 2021-02-02 2281 kfree_skb(skb); 60c6a63a3d3080 Mark-YW.Chen 2021-10-14 2282 kfree(urb->setup_packet); de71a6cb4bf24d Jupeng Zhong 2021-02-02 2283 return; de71a6cb4bf24d Jupeng Zhong 2021-02-02 2284 } a1c49c434e1505 Sean Wang 2019-06-02 2285 } a1c49c434e1505 Sean Wang 2019-06-02 2286 a1c49c434e1505 Sean Wang 2019-06-02 2287 err = hci_recv_frame(hdev, skb); de71a6cb4bf24d Jupeng Zhong 2021-02-02 2288 if (err < 0) { de71a6cb4bf24d Jupeng Zhong 2021-02-02 2289 kfree_skb(data->evt_skb); de71a6cb4bf24d Jupeng Zhong 2021-02-02 2290 data->evt_skb = NULL; 60c6a63a3d3080 Mark-YW.Chen 2021-10-14 2291 kfree(urb->setup_packet); de71a6cb4bf24d Jupeng Zhong 2021-02-02 2292 return; de71a6cb4bf24d Jupeng Zhong 2021-02-02 2293 } a1c49c434e1505 Sean Wang 2019-06-02 2294 a1c49c434e1505 Sean Wang 2019-06-02 2295 if (test_and_clear_bit(BTUSB_TX_WAIT_VND_EVT, a1c49c434e1505 Sean Wang 2019-06-02 2296 &data->flags)) { a1c49c434e1505 Sean Wang 2019-06-02 2297 /* Barrier to sync with other CPUs */ a1c49c434e1505 Sean Wang 2019-06-02 2298 smp_mb__after_atomic(); a1c49c434e1505 Sean Wang 2019-06-02 2299 wake_up_bit(&data->flags, a1c49c434e1505 Sean Wang 2019-06-02 2300 BTUSB_TX_WAIT_VND_EVT); a1c49c434e1505 Sean Wang 2019-06-02 2301 } 60c6a63a3d3080 Mark-YW.Chen 2021-10-14 2302 kfree(urb->setup_packet); a1c49c434e1505 Sean Wang 2019-06-02 2303 return; a1c49c434e1505 Sean Wang 2019-06-02 2304 } else if (urb->status == -ENOENT) { a1c49c434e1505 Sean Wang 2019-06-02 2305 /* Avoid suspend failed when usb_kill_urb */ a1c49c434e1505 Sean Wang 2019-06-02 2306 return; a1c49c434e1505 Sean Wang 2019-06-02 2307 } a1c49c434e1505 Sean Wang 2019-06-02 2308 a1c49c434e1505 Sean Wang 2019-06-02 2309 usb_mark_last_busy(data->udev); a1c49c434e1505 Sean Wang 2019-06-02 2310 a1c49c434e1505 Sean Wang 2019-06-02 2311 /* The URB complete handler is still called with urb->actual_length = 0 a1c49c434e1505 Sean Wang 2019-06-02 2312 * when the event is not available, so we should keep re-submitting a1c49c434e1505 Sean Wang 2019-06-02 2313 * URB until WMT event returns, Also, It's necessary to wait some time a1c49c434e1505 Sean Wang 2019-06-02 2314 * between the two consecutive control URBs to relax the target device a1c49c434e1505 Sean Wang 2019-06-02 2315 * to generate the event. Otherwise, the WMT event cannot return from a1c49c434e1505 Sean Wang 2019-06-02 2316 * the device successfully. a1c49c434e1505 Sean Wang 2019-06-02 2317 */ 48c13301e6baba Mark Chen 2021-02-02 2318 udelay(500); a1c49c434e1505 Sean Wang 2019-06-02 2319 a1c49c434e1505 Sean Wang 2019-06-02 2320 usb_anchor_urb(urb, &data->ctrl_anchor); a1c49c434e1505 Sean Wang 2019-06-02 2321 err = usb_submit_urb(urb, GFP_ATOMIC); a1c49c434e1505 Sean Wang 2019-06-02 2322 if (err < 0) { 60c6a63a3d3080 Mark-YW.Chen 2021-10-14 2323 kfree(urb->setup_packet); a1c49c434e1505 Sean Wang 2019-06-02 2324 /* -EPERM: urb is being killed; a1c49c434e1505 Sean Wang 2019-06-02 2325 * -ENODEV: device got disconnected a1c49c434e1505 Sean Wang 2019-06-02 2326 */ a1c49c434e1505 Sean Wang 2019-06-02 2327 if (err != -EPERM && err != -ENODEV) a1c49c434e1505 Sean Wang 2019-06-02 2328 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", a1c49c434e1505 Sean Wang 2019-06-02 2329 urb, -err); a1c49c434e1505 Sean Wang 2019-06-02 2330 usb_unanchor_urb(urb); a1c49c434e1505 Sean Wang 2019-06-02 2331 } a1c49c434e1505 Sean Wang 2019-06-02 2332 } a1c49c434e1505 Sean Wang 2019-06-02 2333 --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/[email protected] _______________________________________________ kbuild mailing list -- [email protected] To unsubscribe send an email to [email protected]
