CC: [email protected] CC: [email protected] BCC: [email protected] CC: [email protected] TO: Florian Fainelli <[email protected]> CC: Thomas Bogendoerfer <[email protected]>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: 5859a2b1991101d6b978f3feb5325dad39421f29 commit: 1d987052e32f3554e84a296c4494551bc60f3877 MIPS: BMIPS: Enable PCI Kconfig date: 4 months ago :::::: branch date: 17 hours ago :::::: commit date: 4 months ago config: mips-randconfig-c004-20220227 (https://download.01.org/0day-ci/archive/20220304/[email protected]/config) compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project d271fc04d5b97b12e6b797c6067d3c96a8d7470e) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # install mips cross compiling tool for clang build # apt-get install binutils-mips-linux-gnu # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1d987052e32f3554e84a296c4494551bc60f3877 git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git git fetch --no-tags linus master git checkout 1d987052e32f3554e84a296c4494551bc60f3877 # save the config file to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=mips clang-analyzer If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <[email protected]> clang-analyzer warnings: (new ones prefixed by >>) pos__ != head__ ? list_entry(pos__, type, member) : NULL; \ ^ mm/zsmalloc.c:723:9: note: Left side of '&&' is false head = list_first_entry_or_null(&class->fullness_list[fullness], ^ include/linux/list.h:546:20: note: expanded from macro 'list_first_entry_or_null' pos__ != head__ ? list_entry(pos__, type, member) : NULL; \ ^ include/linux/list.h:511:2: note: expanded from macro 'list_entry' container_of(ptr, type, member) ^ include/linux/kernel.h:495:61: note: expanded from macro 'container_of' BUILD_BUG_ON_MSG(!__same_type(*(ptr), ((type *)0)->member) && \ ^ mm/zsmalloc.c:723:9: note: Taking false branch head = list_first_entry_or_null(&class->fullness_list[fullness], ^ include/linux/list.h:546:20: note: expanded from macro 'list_first_entry_or_null' pos__ != head__ ? list_entry(pos__, type, member) : NULL; \ ^ include/linux/list.h:511:2: note: expanded from macro 'list_entry' container_of(ptr, type, member) ^ include/linux/kernel.h:495:2: note: expanded from macro 'container_of' BUILD_BUG_ON_MSG(!__same_type(*(ptr), ((type *)0)->member) && \ ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/compiler_types.h:322:2: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:310:2: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ^ include/linux/compiler_types.h:302:3: note: expanded from macro '__compiletime_assert' if (!(condition)) \ ^ mm/zsmalloc.c:723:9: note: Loop condition is false. Exiting loop head = list_first_entry_or_null(&class->fullness_list[fullness], ^ include/linux/list.h:546:20: note: expanded from macro 'list_first_entry_or_null' pos__ != head__ ? list_entry(pos__, type, member) : NULL; \ ^ include/linux/list.h:511:2: note: expanded from macro 'list_entry' container_of(ptr, type, member) ^ include/linux/kernel.h:495:2: note: expanded from macro 'container_of' BUILD_BUG_ON_MSG(!__same_type(*(ptr), ((type *)0)->member) && \ ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/compiler_types.h:322:2: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:310:2: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ^ include/linux/compiler_types.h:300:2: note: expanded from macro '__compiletime_assert' do { \ ^ mm/zsmalloc.c:729:6: note: Assuming pointer value is null if (head && get_zspage_inuse(zspage) < get_zspage_inuse(head)) ^~~~ mm/zsmalloc.c:729:6: note: Assuming 'head' is null if (head && get_zspage_inuse(zspage) < get_zspage_inuse(head)) ^~~~ mm/zsmalloc.c:729:11: note: Left side of '&&' is false if (head && get_zspage_inuse(zspage) < get_zspage_inuse(head)) ^ mm/zsmalloc.c:732:3: note: Calling 'list_add' list_add(&zspage->list, &class->fullness_list[fullness]); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/list.h:86:24: note: Passing null pointer value via 3rd parameter 'next' __list_add(new, head, head->next); ^~~~~~~~~~ include/linux/list.h:86:2: note: Calling '__list_add' __list_add(new, head, head->next); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/list.h:67:6: note: Assuming the condition is false if (!__list_add_valid(new, prev, next)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/list.h:67:2: note: Taking false branch if (!__list_add_valid(new, prev, next)) ^ include/linux/list.h:70:13: note: Access to field 'prev' results in a dereference of a null pointer (loaded from variable 'next') next->prev = new; ~~~~ ^ mm/zsmalloc.c:942:2: warning: Value stored to 'next' is never read [clang-analyzer-deadcode.DeadStores] next = page = get_first_page(zspage); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/zsmalloc.c:942:2: note: Value stored to 'next' is never read next = page = get_first_page(zspage); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Suppressed 6 warnings (5 in non-user code, 1 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 7 warnings generated. Suppressed 7 warnings (6 in non-user code, 1 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 10 warnings generated. >> drivers/char/applicom.c:383:10: warning: Assigned value is garbage or >> undefined [clang-analyzer-core.uninitialized.Assign] NumCard = st_loc.num_card; /* board number to send */ ^ ~~~~~~~~~~~~~~~ drivers/char/applicom.c:366:6: note: Assuming the condition is false if (count != sizeof(struct st_ram_io) + sizeof(struct mailbox)) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/char/applicom.c:366:2: note: Taking false branch if (count != sizeof(struct st_ram_io) + sizeof(struct mailbox)) { ^ drivers/char/applicom.c:376:5: note: Calling 'copy_from_user' if(copy_from_user(&st_loc, buf, sizeof(struct st_ram_io))) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:191:2: note: Taking true branch if (likely(check_copy_size(to, n, false))) ^ include/linux/uaccess.h:192:7: note: Calling '_copy_from_user' n = _copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:157:7: note: Calling 'should_fail_usercopy' if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^~~~~~~~~~~~~~~~~~~~~~ include/linux/fault-inject-usercopy.h:18:49: note: Returning zero, which participates in a condition later static inline bool should_fail_usercopy(void) { return false; } ^~~~~~~~~~~~ include/linux/uaccess.h:157:7: note: Returning from 'should_fail_usercopy' if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:157:6: note: Left side of '&&' is true if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^ include/linux/uaccess.h:157:2: note: Taking true branch if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^ include/linux/uaccess.h:159:9: note: Calling 'raw_copy_from_user' res = raw_copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/mips/include/asm/uaccess.h:455:2: note: Returning without writing to 'to->num_card' return __cu_len_r; ^ include/linux/uaccess.h:159:9: note: Returning from 'raw_copy_from_user' res = raw_copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:161:6: note: Assuming 'res' is 0, which participates in a condition later if (unlikely(res)) ^ include/linux/compiler.h:78:40: note: expanded from macro 'unlikely' # define unlikely(x) __builtin_expect(!!(x), 0) ^~~~ include/linux/uaccess.h:161:2: note: Taking false branch if (unlikely(res)) ^ include/linux/uaccess.h:163:2: note: Returning without writing to 'to->num_card' return res; ^ include/linux/uaccess.h:163:2: note: Returning zero (loaded from 'res'), which participates in a condition later return res; ^~~~~~~~~~ include/linux/uaccess.h:192:7: note: Returning from '_copy_from_user' n = _copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:193:2: note: Returning without writing to 'to->num_card' return n; ^ include/linux/uaccess.h:193:2: note: Returning zero (loaded from 'n'), which participates in a condition later return n; ^~~~~~~~ drivers/char/applicom.c:376:5: note: Returning from 'copy_from_user' if(copy_from_user(&st_loc, buf, sizeof(struct st_ram_io))) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/char/applicom.c:376:2: note: Taking false branch if(copy_from_user(&st_loc, buf, sizeof(struct st_ram_io))) ^ drivers/char/applicom.c:379:5: note: Calling 'copy_from_user' if(copy_from_user(&tmpmailbox, &buf[sizeof(struct st_ram_io)], ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:191:2: note: Taking true branch if (likely(check_copy_size(to, n, false))) ^ include/linux/uaccess.h:192:7: note: Calling '_copy_from_user' n = _copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:157:7: note: Calling 'should_fail_usercopy' if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^~~~~~~~~~~~~~~~~~~~~~ include/linux/fault-inject-usercopy.h:18:49: note: Returning zero, which participates in a condition later static inline bool should_fail_usercopy(void) { return false; } ^~~~~~~~~~~~ include/linux/uaccess.h:157:7: note: Returning from 'should_fail_usercopy' if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:157:6: note: Left side of '&&' is true if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^ include/linux/uaccess.h:157:33: note: Assuming the condition is true if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^ include/linux/compiler.h:77:20: note: expanded from macro 'likely' # define likely(x) __builtin_expect(!!(x), 1) ^~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:157:2: note: Taking true branch if (!should_fail_usercopy() && likely(access_ok(from, n))) { -- ^ include/linux/uaccess.h:163:2: note: Returning without writing to '*to' return res; ^ include/linux/uaccess.h:163:2: note: Returning zero (loaded from 'res'), which participates in a condition later return res; ^~~~~~~~~~ include/linux/uaccess.h:192:7: note: Returning from '_copy_from_user' n = _copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:193:2: note: Returning without writing to '*to' return n; ^ include/linux/uaccess.h:193:2: note: Returning zero (loaded from 'n'), which participates in a condition later return n; ^~~~~~~~ drivers/rapidio/rio_cm.c:1625:6: note: Returning from 'copy_from_user' if (copy_from_user(&entries, arg, sizeof(entries))) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/rapidio/rio_cm.c:1625:2: note: Taking false branch if (copy_from_user(&entries, arg, sizeof(entries))) ^ drivers/rapidio/rio_cm.c:1627:14: note: The left operand of '==' is a garbage value if (entries == 0 || entries > RIO_MAX_MPORTS) ~~~~~~~ ^ drivers/rapidio/rio_cm.c:1720:20: warning: The left operand of '>=' is a garbage value [clang-analyzer-core.UndefinedBinaryOperatorResult] if (chan.mport_id >= RIO_MAX_MPORTS) ^ drivers/rapidio/rio_cm.c:1899:2: note: Control jumps to 'case 2148033285:' at line 1908 switch (cmd) { ^ drivers/rapidio/rio_cm.c:1909:10: note: Calling 'cm_chan_bind' return cm_chan_bind((void __user *)arg); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/rapidio/rio_cm.c:1718:6: note: Calling 'copy_from_user' if (copy_from_user(&chan, arg, sizeof(chan))) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:191:2: note: Taking true branch if (likely(check_copy_size(to, n, false))) ^ include/linux/uaccess.h:192:7: note: Calling '_copy_from_user' n = _copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:157:7: note: Calling 'should_fail_usercopy' if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^~~~~~~~~~~~~~~~~~~~~~ include/linux/fault-inject-usercopy.h:18:49: note: Returning zero, which participates in a condition later static inline bool should_fail_usercopy(void) { return false; } ^~~~~~~~~~~~ include/linux/uaccess.h:157:7: note: Returning from 'should_fail_usercopy' if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:157:6: note: Left side of '&&' is true if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^ include/linux/uaccess.h:157:2: note: Taking true branch if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^ include/linux/uaccess.h:159:9: note: Calling 'raw_copy_from_user' res = raw_copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/mips/include/asm/uaccess.h:455:2: note: Returning without writing to 'to->mport_id' return __cu_len_r; ^ include/linux/uaccess.h:159:9: note: Returning from 'raw_copy_from_user' res = raw_copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:161:6: note: Assuming 'res' is 0, which participates in a condition later if (unlikely(res)) ^ include/linux/compiler.h:78:40: note: expanded from macro 'unlikely' # define unlikely(x) __builtin_expect(!!(x), 0) ^~~~ include/linux/uaccess.h:161:2: note: Taking false branch if (unlikely(res)) ^ include/linux/uaccess.h:163:2: note: Returning without writing to 'to->mport_id' return res; ^ include/linux/uaccess.h:163:2: note: Returning zero (loaded from 'res'), which participates in a condition later return res; ^~~~~~~~~~ include/linux/uaccess.h:192:7: note: Returning from '_copy_from_user' n = _copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:193:2: note: Returning without writing to 'to->mport_id' return n; ^ include/linux/uaccess.h:193:2: note: Returning zero (loaded from 'n'), which participates in a condition later return n; ^~~~~~~~ drivers/rapidio/rio_cm.c:1718:6: note: Returning from 'copy_from_user' if (copy_from_user(&chan, arg, sizeof(chan))) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/rapidio/rio_cm.c:1718:2: note: Taking false branch if (copy_from_user(&chan, arg, sizeof(chan))) ^ drivers/rapidio/rio_cm.c:1720:20: note: The left operand of '>=' is a garbage value if (chan.mport_id >= RIO_MAX_MPORTS) ~~~~~~~~~~~~~ ^ >> drivers/rapidio/rio_cm.c:1758:14: warning: Branch condition evaluates to a >> garbage value [clang-analyzer-core.uninitialized.Branch] accept_to = param.wait_to ? ^ drivers/rapidio/rio_cm.c:1899:2: note: Control jumps to 'case 3221775111:' at line 1912 switch (cmd) { ^ drivers/rapidio/rio_cm.c:1913:10: note: Calling 'cm_chan_accept' return cm_chan_accept(filp, (void __user *)arg); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/rapidio/rio_cm.c:1752:6: note: Calling 'copy_from_user' if (copy_from_user(¶m, arg, sizeof(param))) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:191:2: note: Taking true branch if (likely(check_copy_size(to, n, false))) ^ include/linux/uaccess.h:192:7: note: Calling '_copy_from_user' n = _copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:157:7: note: Calling 'should_fail_usercopy' if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^~~~~~~~~~~~~~~~~~~~~~ include/linux/fault-inject-usercopy.h:18:49: note: Returning zero, which participates in a condition later static inline bool should_fail_usercopy(void) { return false; } ^~~~~~~~~~~~ include/linux/uaccess.h:157:7: note: Returning from 'should_fail_usercopy' if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:157:6: note: Left side of '&&' is true if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^ include/linux/uaccess.h:157:2: note: Taking true branch if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^ include/linux/uaccess.h:159:9: note: Calling 'raw_copy_from_user' res = raw_copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/mips/include/asm/uaccess.h:455:2: note: Returning without writing to 'to->wait_to' return __cu_len_r; ^ include/linux/uaccess.h:159:9: note: Returning from 'raw_copy_from_user' res = raw_copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:161:6: note: Assuming 'res' is 0, which participates in a condition later if (unlikely(res)) ^ include/linux/compiler.h:78:40: note: expanded from macro 'unlikely' # define unlikely(x) __builtin_expect(!!(x), 0) ^~~~ include/linux/uaccess.h:161:2: note: Taking false branch if (unlikely(res)) ^ include/linux/uaccess.h:163:2: note: Returning without writing to 'to->wait_to' return res; ^ include/linux/uaccess.h:163:2: note: Returning zero (loaded from 'res'), which participates in a condition later return res; ^~~~~~~~~~ include/linux/uaccess.h:192:7: note: Returning from '_copy_from_user' n = _copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:193:2: note: Returning without writing to 'to->wait_to' return n; ^ include/linux/uaccess.h:193:2: note: Returning zero (loaded from 'n'), which participates in a condition later return n; ^~~~~~~~ drivers/rapidio/rio_cm.c:1752:6: note: Returning from 'copy_from_user' if (copy_from_user(¶m, arg, sizeof(param))) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/rapidio/rio_cm.c:1752:2: note: Taking false branch if (copy_from_user(¶m, arg, sizeof(param))) ^ drivers/rapidio/rio_cm.c:1755:2: note: Assuming the condition is false riocm_debug(CHOP, "on ch_%d by %s(%d)", ^ drivers/rapidio/rio_cm.c:53:7: note: expanded from macro 'riocm_debug' if (DBG_##level & dbg_level) \ ^~~~~~~~~~~~~~~~~~~~~~~ note: expanded from here drivers/rapidio/rio_cm.c:1755:2: note: Taking false branch riocm_debug(CHOP, "on ch_%d by %s(%d)", ^ drivers/rapidio/rio_cm.c:53:3: note: expanded from macro 'riocm_debug' if (DBG_##level & dbg_level) \ ^ drivers/rapidio/rio_cm.c:1755:2: note: Loop condition is false. Exiting loop riocm_debug(CHOP, "on ch_%d by %s(%d)", ^ drivers/rapidio/rio_cm.c:52:2: note: expanded from macro 'riocm_debug' do { \ ^ drivers/rapidio/rio_cm.c:1758:14: note: Branch condition evaluates to a garbage value accept_to = param.wait_to ? ^~~~~~~~~~~~~ drivers/rapidio/rio_cm.c:1787:20: warning: The left operand of '>=' is a garbage value [clang-analyzer-core.UndefinedBinaryOperatorResult] if (chan.mport_id >= RIO_MAX_MPORTS) ^ drivers/rapidio/rio_cm.c:1899:2: note: Control jumps to 'case 2148033288:' at line 1914 switch (cmd) { ^ drivers/rapidio/rio_cm.c:1915:10: note: Calling 'cm_chan_connect' -- ^~~~ include/linux/uaccess.h:161:2: note: Taking false branch if (unlikely(res)) ^ include/linux/uaccess.h:163:2: note: Returning without writing to 'to->voice' return res; ^ include/linux/uaccess.h:192:7: note: Returning from '_copy_from_user' n = _copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:193:2: note: Returning without writing to 'to->voice' return n; ^ sound/drivers/opl3/opl3_synth.c:116:8: note: Returning from 'copy_from_user' if (copy_from_user(¬e, argp, sizeof(struct snd_dm_fm_note))) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/drivers/opl3/opl3_synth.c:116:4: note: Taking false branch if (copy_from_user(¬e, argp, sizeof(struct snd_dm_fm_note))) ^ sound/drivers/opl3/opl3_synth.c:118:11: note: Calling 'snd_opl3_play_note' return snd_opl3_play_note(opl3, ¬e); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/drivers/opl3/opl3_synth.c:400:23: note: Assuming field 'fm_mode' is not equal to SNDRV_DM_FM_MODE_OPL3 if (note->voice >= ((opl3->fm_mode == SNDRV_DM_FM_MODE_OPL3) ? ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/drivers/opl3/opl3_synth.c:400:22: note: '?' condition is false if (note->voice >= ((opl3->fm_mode == SNDRV_DM_FM_MODE_OPL3) ? ^ sound/drivers/opl3/opl3_synth.c:400:18: note: The left operand of '>=' is a garbage value if (note->voice >= ((opl3->fm_mode == SNDRV_DM_FM_MODE_OPL3) ? ~~~~~~~~~~~ ^ sound/drivers/opl3/opl3_synth.c:447:16: warning: The left operand of '>' is a garbage value [clang-analyzer-core.UndefinedBinaryOperatorResult] if (voice->op > 1) ^ sound/drivers/opl3/opl3_synth.c:85:17: note: Assuming 'opl3' is non-null if (snd_BUG_ON(!opl3)) ^ include/sound/core.h:413:25: note: expanded from macro 'snd_BUG_ON' int __ret_warn_on = !!(condition); \ ^~~~~~~~~ sound/drivers/opl3/opl3_synth.c:85:2: note: Taking false branch if (snd_BUG_ON(!opl3)) ^ sound/drivers/opl3/opl3_synth.c:88:2: note: Control jumps to 'case 2148681763:' at line 121 switch (cmd) { ^ sound/drivers/opl3/opl3_synth.c:127:8: note: Calling 'copy_from_user' if (copy_from_user(&voice, argp, sizeof(struct snd_dm_fm_voice))) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:191:2: note: Taking true branch if (likely(check_copy_size(to, n, false))) ^ include/linux/uaccess.h:192:7: note: Calling '_copy_from_user' n = _copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:157:6: note: Left side of '&&' is true if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^ include/linux/uaccess.h:157:2: note: Taking true branch if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^ include/linux/uaccess.h:159:9: note: Calling 'raw_copy_from_user' res = raw_copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/mips/include/asm/uaccess.h:455:2: note: Returning without writing to 'to->op' return __cu_len_r; ^ include/linux/uaccess.h:159:9: note: Returning from 'raw_copy_from_user' res = raw_copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:161:6: note: Assuming 'res' is 0 if (unlikely(res)) ^ include/linux/compiler.h:78:40: note: expanded from macro 'unlikely' # define unlikely(x) __builtin_expect(!!(x), 0) ^~~~ include/linux/uaccess.h:161:2: note: Taking false branch if (unlikely(res)) ^ include/linux/uaccess.h:163:2: note: Returning without writing to 'to->op' return res; ^ include/linux/uaccess.h:192:7: note: Returning from '_copy_from_user' n = _copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:193:2: note: Returning without writing to 'to->op' return n; ^ sound/drivers/opl3/opl3_synth.c:127:8: note: Returning from 'copy_from_user' if (copy_from_user(&voice, argp, sizeof(struct snd_dm_fm_voice))) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/drivers/opl3/opl3_synth.c:127:4: note: Taking false branch if (copy_from_user(&voice, argp, sizeof(struct snd_dm_fm_voice))) ^ sound/drivers/opl3/opl3_synth.c:129:11: note: Calling 'snd_opl3_set_voice' return snd_opl3_set_voice(opl3, &voice); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/drivers/opl3/opl3_synth.c:447:16: note: The left operand of '>' is a garbage value if (voice->op > 1) ~~~~~~~~~ ^ >> sound/drivers/opl3/opl3_synth.c:547:6: warning: Branch condition evaluates >> to a garbage value [clang-analyzer-core.uninitialized.Branch] if (params->kbd_split) ^ sound/drivers/opl3/opl3_synth.c:85:17: note: Assuming 'opl3' is non-null if (snd_BUG_ON(!opl3)) ^ include/sound/core.h:413:25: note: expanded from macro 'snd_BUG_ON' int __ret_warn_on = !!(condition); \ ^~~~~~~~~ sound/drivers/opl3/opl3_synth.c:85:2: note: Taking false branch if (snd_BUG_ON(!opl3)) ^ sound/drivers/opl3/opl3_synth.c:88:2: note: Control jumps to 'case 2148091940:' at line 132 switch (cmd) { ^ sound/drivers/opl3/opl3_synth.c:138:8: note: Calling 'copy_from_user' if (copy_from_user(¶ms, argp, sizeof(struct snd_dm_fm_params))) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:191:2: note: Taking true branch if (likely(check_copy_size(to, n, false))) ^ include/linux/uaccess.h:192:7: note: Calling '_copy_from_user' n = _copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:157:6: note: Left side of '&&' is true if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^ include/linux/uaccess.h:157:2: note: Taking true branch if (!should_fail_usercopy() && likely(access_ok(from, n))) { ^ include/linux/uaccess.h:159:9: note: Calling 'raw_copy_from_user' res = raw_copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/mips/include/asm/uaccess.h:455:2: note: Returning without writing to 'to->kbd_split' return __cu_len_r; ^ include/linux/uaccess.h:159:9: note: Returning from 'raw_copy_from_user' res = raw_copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:161:6: note: Assuming 'res' is 0 if (unlikely(res)) ^ include/linux/compiler.h:78:40: note: expanded from macro 'unlikely' # define unlikely(x) __builtin_expect(!!(x), 0) ^~~~ include/linux/uaccess.h:161:2: note: Taking false branch if (unlikely(res)) ^ include/linux/uaccess.h:163:2: note: Returning without writing to 'to->kbd_split' return res; ^ include/linux/uaccess.h:192:7: note: Returning from '_copy_from_user' n = _copy_from_user(to, from, n); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:193:2: note: Returning without writing to 'to->kbd_split' return n; ^ sound/drivers/opl3/opl3_synth.c:138:8: note: Returning from 'copy_from_user' if (copy_from_user(¶ms, argp, sizeof(struct snd_dm_fm_params))) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/drivers/opl3/opl3_synth.c:138:4: note: Taking false branch if (copy_from_user(¶ms, argp, sizeof(struct snd_dm_fm_params))) ^ sound/drivers/opl3/opl3_synth.c:140:11: note: Calling 'snd_opl3_set_params' return snd_opl3_set_params(opl3, ¶ms); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/drivers/opl3/opl3_synth.c:547:6: note: Branch condition evaluates to a garbage value if (params->kbd_split) ^~~~~~~~~~~~~~~~~ Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 6 warnings generated. drivers/comedi/drivers/amplc_pci230.c:1477:24: warning: Division by zero [clang-analyzer-core.DivideZero] if (cmd->chanlist_len % subseq_len) { ~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~ drivers/comedi/drivers/amplc_pci230.c:1416:14: note: Assuming 'i' is >= field 'chanlist_len' for (i = 0; i < cmd->chanlist_len; i++) { ^~~~~~~~~~~~~~~~~~~~~ drivers/comedi/drivers/amplc_pci230.c:1416:2: note: Loop condition is false. Execution continues on line 1474 for (i = 0; i < cmd->chanlist_len; i++) { ^ drivers/comedi/drivers/amplc_pci230.c:1474:6: note: 'subseq_len' is equal to 0 if (subseq_len == 0) ^~~~~~~~~~ drivers/comedi/drivers/amplc_pci230.c:1474:2: note: Taking true branch if (subseq_len == 0) ^ drivers/comedi/drivers/amplc_pci230.c:1475:3: note: The value 0 is assigned to 'subseq_len' subseq_len = cmd->chanlist_len; ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/comedi/drivers/amplc_pci230.c:1477:24: note: Division by zero if (cmd->chanlist_len % subseq_len) { ~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~ Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 6 warnings generated. Suppressed 6 warnings (5 in non-user code, 1 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. -- include/linux/compiler_types.h:322:2: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:310:2: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ^ include/linux/compiler_types.h:302:3: note: expanded from macro '__compiletime_assert' if (!(condition)) \ ^ sound/core/control.c:2197:13: note: Loop condition is false. Exiting loop control = snd_kcontrol(card->controls.next); ^ include/sound/control.h:87:25: note: expanded from macro 'snd_kcontrol' #define snd_kcontrol(n) list_entry(n, struct snd_kcontrol, list) ^ include/linux/list.h:511:2: note: expanded from macro 'list_entry' container_of(ptr, type, member) ^ include/linux/kernel.h:495:2: note: expanded from macro 'container_of' BUILD_BUG_ON_MSG(!__same_type(*(ptr), ((type *)0)->member) && \ ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/compiler_types.h:322:2: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:310:2: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ^ include/linux/compiler_types.h:300:2: note: expanded from macro '__compiletime_assert' do { \ ^ sound/core/control.c:2198:3: note: Use of memory after it is freed snd_ctl_remove(card, control); ^ ~~~~~~~ Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 7 warnings generated. sound/pci/riptide/riptide.c:860:2: warning: Value stored to 'err' is never read [clang-analyzer-deadcode.DeadStores] err = 0; ^ ~ sound/pci/riptide/riptide.c:860:2: note: Value stored to 'err' is never read err = 0; ^ ~ sound/pci/riptide/riptide.c:947:15: warning: The left operand of '<' is a garbage value [clang-analyzer-core.UndefinedBinaryOperatorResult] if (sink[i] < E2SINK_MAX) { ~~~~~~~ ^ sound/pci/riptide/riptide.c:945:7: note: The value 0 is assigned to 'i' for (i = 0; i < E2SINK_MAX; i++) { ^~~~~ sound/pci/riptide/riptide.c:945:2: note: Loop condition is true. Entering loop body for (i = 0; i < E2SINK_MAX; i++) { ^ sound/pci/riptide/riptide.c:946:3: note: Calling 'getsourcesink' getsourcesink(cif, i, i, &src[i], &sink[i]); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/pci/riptide/riptide.c:961:6: note: Assuming the condition is true if (SEND_RSSV(cif, source, sink, &rptr) && ^ sound/pci/riptide/riptide.c:249:36: note: expanded from macro 'SEND_RSSV' #define SEND_RSSV(p,b,c,d) sendcmd(p,PARM|RESP,RSSV,BYTE2(b)|BYTE3(c),RET(d)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/pci/riptide/riptide.c:961:6: note: Left side of '&&' is true if (SEND_RSSV(cif, source, sink, &rptr) && ^ sound/pci/riptide/riptide.c:249:36: note: expanded from macro 'SEND_RSSV' #define SEND_RSSV(p,b,c,d) sendcmd(p,PARM|RESP,RSSV,BYTE2(b)|BYTE3(c),RET(d)) ^ sound/pci/riptide/riptide.c:962:6: note: Assuming the condition is true SEND_RSSV(cif, source, sink, &rptr)) ^ sound/pci/riptide/riptide.c:249:36: note: expanded from macro 'SEND_RSSV' #define SEND_RSSV(p,b,c,d) sendcmd(p,PARM|RESP,RSSV,BYTE2(b)|BYTE3(c),RET(d)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/pci/riptide/riptide.c:961:2: note: Taking true branch if (SEND_RSSV(cif, source, sink, &rptr) && ^ sound/pci/riptide/riptide.c:963:3: note: Returning without writing to '*b' return -EIO; ^ sound/pci/riptide/riptide.c:946:3: note: Returning from 'getsourcesink' getsourcesink(cif, i, i, &src[i], &sink[i]); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/pci/riptide/riptide.c:947:15: note: The left operand of '<' is a garbage value if (sink[i] < E2SINK_MAX) { ~~~~~~~ ^ Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 8 warnings generated. sound/pci/rme9652/hdsp.c:3314:28: warning: Although the value stored to 'kctl' is used in the enclosing expression, the value is never actually read from 'kctl' [clang-analyzer-deadcode.DeadStores] err = snd_ctl_add(card, kctl = snd_ctl_new1(&snd_hdsp_rpm_controls[idx], hdsp)); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/pci/rme9652/hdsp.c:3314:28: note: Although the value stored to 'kctl' is used in the enclosing expression, the value is never actually read from 'kctl' err = snd_ctl_add(card, kctl = snd_ctl_new1(&snd_hdsp_rpm_controls[idx], hdsp)); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> sound/pci/rme9652/hdsp.c:4887:17: warning: Assigned value is garbage or >> undefined [clang-analyzer-core.uninitialized.Assign] firmware_data = (u32 __user *)firmware.firmware_data; ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/pci/rme9652/hdsp.c:4757:2: note: Control jumps to 'case 2147764290:' at line 4871 switch (cmd) { ^ sound/pci/rme9652/hdsp.c:4876:7: note: Assuming field 'io_type' is not equal to H9652 if (hdsp->io_type == H9652 || hdsp->io_type == H9632) return -EINVAL; ^~~~~~~~~~~~~~~~~~~~~~ sound/pci/rme9652/hdsp.c:4876:7: note: Left side of '||' is false sound/pci/rme9652/hdsp.c:4876:33: note: Assuming field 'io_type' is not equal to H9632 if (hdsp->io_type == H9652 || hdsp->io_type == H9632) return -EINVAL; ^~~~~~~~~~~~~~~~~~~~~~ sound/pci/rme9652/hdsp.c:4876:3: note: Taking false branch if (hdsp->io_type == H9652 || hdsp->io_type == H9632) return -EINVAL; ^ sound/pci/rme9652/hdsp.c:4878:7: note: Assuming field 'io_type' is not equal to Undefined if (hdsp->io_type == Undefined) return -EINVAL; ^~~~~~~~~~~~~~~~~~~~~~~~~~ sound/pci/rme9652/hdsp.c:4878:3: note: Taking false branch if (hdsp->io_type == Undefined) return -EINVAL; ^ sound/pci/rme9652/hdsp.c:4880:7: note: Assuming the condition is false if (hdsp->state & (HDSP_FirmwareCached | HDSP_FirmwareLoaded)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/pci/rme9652/hdsp.c:4880:3: note: Taking false branch if (hdsp->state & (HDSP_FirmwareCached | HDSP_FirmwareLoaded)) ^ sound/pci/rme9652/hdsp.c:4883:3: note: Left side of '&&' is true dev_info(hdsp->card->dev, ^ include/linux/dev_printk.h:150:2: note: expanded from macro 'dev_info' dev_printk_index_wrap(_dev_info, KERN_INFO, dev, dev_fmt(fmt), ##__VA_ARGS__) ^ include/linux/dev_printk.h:109:3: note: expanded from macro 'dev_printk_index_wrap' dev_printk_index_emit(level, fmt); \ ^ include/linux/dev_printk.h:105:2: note: expanded from macro 'dev_printk_index_emit' printk_index_subsys_emit("%s %s: ", level, fmt) ^ include/linux/printk.h:413:2: note: expanded from macro 'printk_index_subsys_emit' __printk_index_emit(fmt, level, subsys_fmt_prefix) ^ include/linux/printk.h:370:7: note: expanded from macro '__printk_index_emit' if (__builtin_constant_p(_fmt) && __builtin_constant_p(_level)) { \ ^ sound/pci/rme9652/hdsp.c:4883:3: note: Taking true branch dev_info(hdsp->card->dev, ^ include/linux/dev_printk.h:150:2: note: expanded from macro 'dev_info' dev_printk_index_wrap(_dev_info, KERN_INFO, dev, dev_fmt(fmt), ##__VA_ARGS__) ^ include/linux/dev_printk.h:109:3: note: expanded from macro 'dev_printk_index_wrap' dev_printk_index_emit(level, fmt); \ ^ include/linux/dev_printk.h:105:2: note: expanded from macro 'dev_printk_index_emit' printk_index_subsys_emit("%s %s: ", level, fmt) ^ include/linux/printk.h:413:2: note: expanded from macro 'printk_index_subsys_emit' __printk_index_emit(fmt, level, subsys_fmt_prefix) ^ include/linux/printk.h:370:3: note: expanded from macro '__printk_index_emit' if (__builtin_constant_p(_fmt) && __builtin_constant_p(_level)) { \ ^ sound/pci/rme9652/hdsp.c:4883:3: note: '?' condition is true dev_info(hdsp->card->dev, ^ include/linux/dev_printk.h:150:2: note: expanded from macro 'dev_info' dev_printk_index_wrap(_dev_info, KERN_INFO, dev, dev_fmt(fmt), ##__VA_ARGS__) ^ include/linux/dev_printk.h:109:3: note: expanded from macro 'dev_printk_index_wrap' dev_printk_index_emit(level, fmt); \ ^ include/linux/dev_printk.h:105:2: note: expanded from macro 'dev_printk_index_emit' printk_index_subsys_emit("%s %s: ", level, fmt) ^ include/linux/printk.h:413:2: note: expanded from macro 'printk_index_subsys_emit' __printk_index_emit(fmt, level, subsys_fmt_prefix) ^ include/linux/printk.h:379:12: note: expanded from macro '__printk_index_emit' .fmt = __builtin_constant_p(_fmt) ? (_fmt) : NULL, \ ^ sound/pci/rme9652/hdsp.c:4883:3: note: '?' condition is true dev_info(hdsp->card->dev, ^ include/linux/dev_printk.h:150:2: note: expanded from macro 'dev_info' dev_printk_index_wrap(_dev_info, KERN_INFO, dev, dev_fmt(fmt), ##__VA_ARGS__) ^ include/linux/dev_printk.h:109:3: note: expanded from macro 'dev_printk_index_wrap' dev_printk_index_emit(level, fmt); \ ^ include/linux/dev_printk.h:105:2: note: expanded from macro 'dev_printk_index_emit' printk_index_subsys_emit("%s %s: ", level, fmt) ^ include/linux/printk.h:413:2: note: expanded from macro 'printk_index_subsys_emit' __printk_index_emit(fmt, level, subsys_fmt_prefix) ^ include/linux/printk.h:383:14: note: expanded from macro '__printk_index_emit' .level = __builtin_constant_p(_level) ? (_level) : NULL, \ ^ sound/pci/rme9652/hdsp.c:4883:3: note: Loop condition is false. Exiting loop -- ^~~~~~~~~~~~ net/sched/cls_flow.c:316:3: note: Loop condition is false. Execution continues on line 322 for (n = 0; n < f->nkeys; n++) { ^ net/sched/cls_flow.c:322:7: note: Assuming field 'mode' is not equal to FLOW_MODE_HASH if (f->mode == FLOW_MODE_HASH) ^~~~~~~~~~~~~~~~~~~~~~~~~ net/sched/cls_flow.c:322:3: note: Taking false branch if (f->mode == FLOW_MODE_HASH) ^ net/sched/cls_flow.c:325:12: note: Assigned value is garbage or undefined classid = keys[0]; ^ ~~~~~~~ Suppressed 12 warnings (12 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 11 warnings generated. drivers/gpu/drm/nouveau/nouveau_display.c:148:9: warning: Dereference of null pointer (loaded from variable 'kind') [clang-analyzer-core.NullDereference] *kind = 0; ^ drivers/gpu/drm/nouveau/nouveau_display.c:173:6: note: Assuming the condition is true if (fb->flags & DRM_MODE_FB_MODIFIERS) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/nouveau/nouveau_display.c:173:2: note: Taking true branch if (fb->flags & DRM_MODE_FB_MODIFIERS) { ^ drivers/gpu/drm/nouveau/nouveau_display.c:176:52: note: Passing value via 4th parameter 'kind' nouveau_decode_mod(drm, fb->modifier, tile_mode, kind); ^~~~ drivers/gpu/drm/nouveau/nouveau_display.c:176:3: note: Calling 'nouveau_decode_mod' nouveau_decode_mod(drm, fb->modifier, tile_mode, kind); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/nouveau/nouveau_display.c:143:9: note: Assuming 'tile_mode' is non-null BUG_ON(!tile_mode || !kind); ^ arch/mips/include/asm/bug.h:34:44: note: expanded from macro 'BUG_ON' #define BUG_ON(C) __BUG_ON((unsigned long)(C)) ^ drivers/gpu/drm/nouveau/nouveau_display.c:143:9: note: Left side of '||' is false BUG_ON(!tile_mode || !kind); ^ drivers/gpu/drm/nouveau/nouveau_display.c:143:23: note: Assuming 'kind' is null BUG_ON(!tile_mode || !kind); ^ arch/mips/include/asm/bug.h:34:44: note: expanded from macro 'BUG_ON' #define BUG_ON(C) __BUG_ON((unsigned long)(C)) ^ drivers/gpu/drm/nouveau/nouveau_display.c:145:6: note: Assuming the condition is true if (modifier == DRM_FORMAT_MOD_LINEAR) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/nouveau/nouveau_display.c:145:2: note: Taking true branch if (modifier == DRM_FORMAT_MOD_LINEAR) { ^ drivers/gpu/drm/nouveau/nouveau_display.c:148:9: note: Dereference of null pointer (loaded from variable 'kind') *kind = 0; ~~~~ ^ drivers/gpu/drm/nouveau/nouveau_display.c:161:9: warning: Dereference of null pointer (loaded from variable 'kind') [clang-analyzer-core.NullDereference] *kind = (uint8_t)((modifier >> 12) & 0xFF); ^ drivers/gpu/drm/nouveau/nouveau_display.c:173:6: note: Assuming the condition is true if (fb->flags & DRM_MODE_FB_MODIFIERS) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/nouveau/nouveau_display.c:173:2: note: Taking true branch if (fb->flags & DRM_MODE_FB_MODIFIERS) { ^ drivers/gpu/drm/nouveau/nouveau_display.c:176:52: note: Passing value via 4th parameter 'kind' nouveau_decode_mod(drm, fb->modifier, tile_mode, kind); ^~~~ drivers/gpu/drm/nouveau/nouveau_display.c:176:3: note: Calling 'nouveau_decode_mod' nouveau_decode_mod(drm, fb->modifier, tile_mode, kind); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/nouveau/nouveau_display.c:143:9: note: Assuming 'tile_mode' is non-null BUG_ON(!tile_mode || !kind); ^ arch/mips/include/asm/bug.h:34:44: note: expanded from macro 'BUG_ON' #define BUG_ON(C) __BUG_ON((unsigned long)(C)) ^ drivers/gpu/drm/nouveau/nouveau_display.c:143:9: note: Left side of '||' is false BUG_ON(!tile_mode || !kind); ^ drivers/gpu/drm/nouveau/nouveau_display.c:143:23: note: Assuming 'kind' is null BUG_ON(!tile_mode || !kind); ^ arch/mips/include/asm/bug.h:34:44: note: expanded from macro 'BUG_ON' #define BUG_ON(C) __BUG_ON((unsigned long)(C)) ^ drivers/gpu/drm/nouveau/nouveau_display.c:145:6: note: Assuming the condition is false if (modifier == DRM_FORMAT_MOD_LINEAR) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/nouveau/nouveau_display.c:145:2: note: Taking false branch if (modifier == DRM_FORMAT_MOD_LINEAR) { ^ drivers/gpu/drm/nouveau/nouveau_display.c:155:7: note: Assuming the condition is false if ((modifier & (0xffull << 12)) == 0ull) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/nouveau/nouveau_display.c:155:3: note: Taking false branch if ((modifier & (0xffull << 12)) == 0ull) { ^ drivers/gpu/drm/nouveau/nouveau_display.c:161:9: note: Dereference of null pointer (loaded from variable 'kind') *kind = (uint8_t)((modifier >> 12) & 0xFF); ~~~~ ^ >> drivers/gpu/drm/nouveau/nouveau_display.c:211:8: warning: Array access (via >> field 'format_modifiers') results in a null pointer dereference >> [clang-analyzer-core.NullDereference] (disp->format_modifiers[mod] != DRM_FORMAT_MOD_INVALID) && ^ drivers/gpu/drm/nouveau/nouveau_display.c:390:6: note: Assuming 'gem' is non-null if (!gem) ^~~~ drivers/gpu/drm/nouveau/nouveau_display.c:390:2: note: Taking false branch if (!gem) ^ drivers/gpu/drm/nouveau/nouveau_display.c:393:8: note: Calling 'nouveau_framebuffer_new' ret = nouveau_framebuffer_new(dev, mode_cmd, gem, &fb); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/nouveau/nouveau_display.c:315:6: note: Assuming field 'family' is >= NV_DEVICE_INFO_V0_TESLA if (drm->client.device.info.family < NV_DEVICE_INFO_V0_TESLA && ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/nouveau/nouveau_display.c:315:63: note: Left side of '&&' is false if (drm->client.device.info.family < NV_DEVICE_INFO_V0_TESLA && ^ drivers/gpu/drm/nouveau/nouveau_display.c:331:6: note: Assuming the condition is true if (mode_cmd->flags & DRM_MODE_FB_MODIFIERS) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/nouveau/nouveau_display.c:331:2: note: Taking true branch if (mode_cmd->flags & DRM_MODE_FB_MODIFIERS) { ^ drivers/gpu/drm/nouveau/nouveau_display.c:332:7: note: Calling 'nouveau_validate_decode_mod' if (nouveau_validate_decode_mod(drm, mode_cmd->modifier[0], ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/nouveau/nouveau_display.c:204:30: note: Field 'family' is >= NV_DEVICE_INFO_V0_TESLA if (drm->client.device.info.family < NV_DEVICE_INFO_V0_TESLA) { ^ drivers/gpu/drm/nouveau/nouveau_display.c:204:2: note: Taking false branch if (drm->client.device.info.family < NV_DEVICE_INFO_V0_TESLA) { ^ drivers/gpu/drm/nouveau/nouveau_display.c:208:9: note: Assuming field 'format_modifiers' is null BUG_ON(!disp->format_modifiers); ^ arch/mips/include/asm/bug.h:34:44: note: expanded from macro 'BUG_ON' #define BUG_ON(C) __BUG_ON((unsigned long)(C)) ^ drivers/gpu/drm/nouveau/nouveau_display.c:211:8: note: Array access (via field 'format_modifiers') results in a null pointer dereference (disp->format_modifiers[mod] != DRM_FORMAT_MOD_INVALID) && ^ ~~~~~~~~~~~~~~~~ drivers/gpu/drm/nouveau/nouveau_display.c:346:3: warning: Value stored to 'width' is never read [clang-analyzer-deadcode.DeadStores] width = drm_format_info_plane_width(info, ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/nouveau/nouveau_display.c:346:3: note: Value stored to 'width' is never read width = drm_format_info_plane_width(info, ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Suppressed 7 warnings (6 in non-user code, 1 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 6 warnings generated. Suppressed 6 warnings (6 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 7 warnings generated. drivers/leds/leds-pca9532.c:516:23: warning: Value stored to 'data' during its initialization is never read [clang-analyzer-deadcode.DeadStores] struct pca9532_data *data = i2c_get_clientdata(client); ^~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/leds/leds-pca9532.c:516:23: note: Value stored to 'data' during its initialization is never read struct pca9532_data *data = i2c_get_clientdata(client); ^~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~ Suppressed 6 warnings (6 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 6 warnings generated. Suppressed 6 warnings (6 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 6 warnings generated. Suppressed 6 warnings (6 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. Suppressed 5 warnings (5 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 6 warnings generated. Suppressed 6 warnings (6 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 7 warnings generated. sound/core/pcm_lib.c:240:43: warning: The right operand of '!=' is a garbage value [clang-analyzer-core.UndefinedBinaryOperatorResult] if (runtime->status->audio_tstamp.tv_sec != audio_tstamp->tv_sec || vim +383 drivers/char/applicom.c ^1da177e4c3f415 Linus Torvalds 2005-04-16 351 ^1da177e4c3f415 Linus Torvalds 2005-04-16 352 ^1da177e4c3f415 Linus Torvalds 2005-04-16 353 static ssize_t ac_write(struct file *file, const char __user *buf, size_t count, loff_t * ppos) ^1da177e4c3f415 Linus Torvalds 2005-04-16 354 { ^1da177e4c3f415 Linus Torvalds 2005-04-16 355 unsigned int NumCard; /* Board number 1 -> 8 */ ^1da177e4c3f415 Linus Torvalds 2005-04-16 356 unsigned int IndexCard; /* Index board number 0 -> 7 */ ^1da177e4c3f415 Linus Torvalds 2005-04-16 357 unsigned char TicCard; /* Board TIC to send */ ^1da177e4c3f415 Linus Torvalds 2005-04-16 358 unsigned long flags; /* Current priority */ ^1da177e4c3f415 Linus Torvalds 2005-04-16 359 struct st_ram_io st_loc; ^1da177e4c3f415 Linus Torvalds 2005-04-16 360 struct mailbox tmpmailbox; ^1da177e4c3f415 Linus Torvalds 2005-04-16 361 #ifdef DEBUG ^1da177e4c3f415 Linus Torvalds 2005-04-16 362 int c; ^1da177e4c3f415 Linus Torvalds 2005-04-16 363 #endif ^1da177e4c3f415 Linus Torvalds 2005-04-16 364 DECLARE_WAITQUEUE(wait, current); ^1da177e4c3f415 Linus Torvalds 2005-04-16 365 ^1da177e4c3f415 Linus Torvalds 2005-04-16 366 if (count != sizeof(struct st_ram_io) + sizeof(struct mailbox)) { ^1da177e4c3f415 Linus Torvalds 2005-04-16 367 static int warncount = 5; ^1da177e4c3f415 Linus Torvalds 2005-04-16 368 if (warncount) { ^1da177e4c3f415 Linus Torvalds 2005-04-16 369 printk(KERN_INFO "Hmmm. write() of Applicom card, length %zd != expected %zd\n", ^1da177e4c3f415 Linus Torvalds 2005-04-16 370 count, sizeof(struct st_ram_io) + sizeof(struct mailbox)); ^1da177e4c3f415 Linus Torvalds 2005-04-16 371 warncount--; ^1da177e4c3f415 Linus Torvalds 2005-04-16 372 } ^1da177e4c3f415 Linus Torvalds 2005-04-16 373 return -EINVAL; ^1da177e4c3f415 Linus Torvalds 2005-04-16 374 } ^1da177e4c3f415 Linus Torvalds 2005-04-16 375 ^1da177e4c3f415 Linus Torvalds 2005-04-16 376 if(copy_from_user(&st_loc, buf, sizeof(struct st_ram_io))) ^1da177e4c3f415 Linus Torvalds 2005-04-16 377 return -EFAULT; ^1da177e4c3f415 Linus Torvalds 2005-04-16 378 ^1da177e4c3f415 Linus Torvalds 2005-04-16 379 if(copy_from_user(&tmpmailbox, &buf[sizeof(struct st_ram_io)], ^1da177e4c3f415 Linus Torvalds 2005-04-16 380 sizeof(struct mailbox))) ^1da177e4c3f415 Linus Torvalds 2005-04-16 381 return -EFAULT; ^1da177e4c3f415 Linus Torvalds 2005-04-16 382 ^1da177e4c3f415 Linus Torvalds 2005-04-16 @383 NumCard = st_loc.num_card; /* board number to send */ ^1da177e4c3f415 Linus Torvalds 2005-04-16 384 TicCard = st_loc.tic_des_from_pc; /* tic number to send */ ^1da177e4c3f415 Linus Torvalds 2005-04-16 385 IndexCard = NumCard - 1; ^1da177e4c3f415 Linus Torvalds 2005-04-16 386 d7ac3c6ef5d8ce1 Gustavo A. R. Silva 2019-01-09 387 if (IndexCard >= MAX_BOARD) d7ac3c6ef5d8ce1 Gustavo A. R. Silva 2019-01-09 388 return -EINVAL; d7ac3c6ef5d8ce1 Gustavo A. R. Silva 2019-01-09 389 IndexCard = array_index_nospec(IndexCard, MAX_BOARD); d7ac3c6ef5d8ce1 Gustavo A. R. Silva 2019-01-09 390 d7ac3c6ef5d8ce1 Gustavo A. R. Silva 2019-01-09 391 if (!apbs[IndexCard].RamIO) ^1da177e4c3f415 Linus Torvalds 2005-04-16 392 return -EINVAL; ^1da177e4c3f415 Linus Torvalds 2005-04-16 393 :::::: The code at line 383 was first introduced by commit :::::: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Linux-2.6.12-rc2 :::::: TO: Linus Torvalds <[email protected]> :::::: CC: Linus Torvalds <[email protected]> --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/[email protected] _______________________________________________ kbuild mailing list -- [email protected] To unsubscribe send an email to [email protected]
