CC: [email protected] CC: [email protected] BCC: [email protected] CC: Linux Memory Management List <[email protected]> TO: Hangbin Liu <[email protected]>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master head: 91265a6da44d13296bdb5b3fbafa19d06be462f2 commit: 1fcd5d448c59ca2703504806eb8131ce8e411a70 [6772/10468] Bonding: split bond_handle_vlan from bond_arp_send :::::: branch date: 19 hours ago :::::: commit date: 11 days ago config: riscv-randconfig-c006-20220303 (https://download.01.org/0day-ci/archive/20220304/[email protected]/config) compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project d271fc04d5b97b12e6b797c6067d3c96a8d7470e) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # install riscv cross compiling tool for clang build # apt-get install binutils-riscv64-linux-gnu # https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=1fcd5d448c59ca2703504806eb8131ce8e411a70 git remote add linux-next https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git git fetch --no-tags linux-next master git checkout 1fcd5d448c59ca2703504806eb8131ce8e411a70 # save the config file to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=riscv clang-analyzer If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <[email protected]> clang-analyzer warnings: (new ones prefixed by >>) ^~~~~~~~~~~~~~ include/asm-generic/rwonce.h:44:24: note: expanded from macro '__READ_ONCE' #define __READ_ONCE(x) (*(const volatile __unqual_scalar_typeof(x) *)&(x)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ net/lapb/lapb_iface.c:202:2: warning: Use of memory after it is freed [clang-analyzer-unix.Malloc] lapb_put(lapb); ^ ~~~~ net/lapb/lapb_iface.c:177:2: note: Loop condition is false. Exiting loop write_lock_bh(&lapb_list_lock); ^ include/linux/rwlock.h:95:30: note: expanded from macro 'write_lock_bh' #define write_lock_bh(lock) _raw_write_lock_bh(lock) ^ include/linux/spinlock_api_up.h:65:35: note: expanded from macro '_raw_write_lock_bh' #define _raw_write_lock_bh(lock) __LOCK_BH(lock) ^ include/linux/spinlock_api_up.h:34:63: note: expanded from macro '__LOCK_BH' do { __local_bh_disable_ip(_THIS_IP_, SOFTIRQ_LOCK_OFFSET); ___LOCK(lock); } while (0) ^ include/linux/spinlock_api_up.h:28:3: note: expanded from macro '___LOCK' do { __acquire(lock); (void)(lock); } while (0) ^ net/lapb/lapb_iface.c:177:2: note: Loop condition is false. Exiting loop write_lock_bh(&lapb_list_lock); ^ include/linux/rwlock.h:95:30: note: expanded from macro 'write_lock_bh' #define write_lock_bh(lock) _raw_write_lock_bh(lock) ^ include/linux/spinlock_api_up.h:65:35: note: expanded from macro '_raw_write_lock_bh' #define _raw_write_lock_bh(lock) __LOCK_BH(lock) ^ include/linux/spinlock_api_up.h:34:3: note: expanded from macro '__LOCK_BH' do { __local_bh_disable_ip(_THIS_IP_, SOFTIRQ_LOCK_OFFSET); ___LOCK(lock); } while (0) ^ net/lapb/lapb_iface.c:179:6: note: Assuming 'lapb' is non-null if (!lapb) ^~~~~ net/lapb/lapb_iface.c:179:2: note: Taking false branch if (!lapb) ^ net/lapb/lapb_iface.c:184:2: note: Loop condition is false. Execution continues on line 187 while (refcount_read(&lapb->refcnt) > 2) ^ net/lapb/lapb_iface.c:200:2: note: Calling '__lapb_remove_cb' __lapb_remove_cb(lapb); ^~~~~~~~~~~~~~~~~~~~~~ net/lapb/lapb_iface.c:66:6: note: Assuming field 'next' is non-null if (lapb->node.next) { ^~~~~~~~~~~~~~~ net/lapb/lapb_iface.c:66:2: note: Taking true branch if (lapb->node.next) { ^ net/lapb/lapb_iface.c:68:3: note: Calling 'lapb_put' lapb_put(lapb); ^~~~~~~~~~~~~~ net/lapb/lapb_iface.c:57:2: note: Taking true branch if (refcount_dec_and_test(&lapb->refcnt)) ^ net/lapb/lapb_iface.c:58:3: note: Calling 'lapb_free_cb' lapb_free_cb(lapb); ^~~~~~~~~~~~~~~~~~ net/lapb/lapb_iface.c:47:2: note: Memory is released kfree(lapb); ^~~~~~~~~~~ net/lapb/lapb_iface.c:58:3: note: Returning; memory was released via 1st parameter lapb_free_cb(lapb); ^~~~~~~~~~~~~~~~~~ net/lapb/lapb_iface.c:68:3: note: Returning; memory was released via 1st parameter lapb_put(lapb); ^~~~~~~~~~~~~~ net/lapb/lapb_iface.c:200:2: note: Returning; memory was released via 1st parameter __lapb_remove_cb(lapb); ^~~~~~~~~~~~~~~~~~~~~~ net/lapb/lapb_iface.c:202:2: note: Use of memory after it is freed lapb_put(lapb); ^ ~~~~ Suppressed 2 warnings (2 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 2 warnings generated. Suppressed 2 warnings (2 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 2 warnings generated. Suppressed 2 warnings (2 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 2 warnings generated. Suppressed 2 warnings (2 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 7 warnings generated. drivers/net/bonding/bond_main.c:1698:2: warning: Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119 [clang-analyzer-security.insecureAPI.strcpy] strcpy(info->slave_name, slave->dev->name); ^~~~~~ drivers/net/bonding/bond_main.c:1698:2: note: Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119 strcpy(info->slave_name, slave->dev->name); ^~~~~~ drivers/net/bonding/bond_main.c:2799:21: warning: Value stored to 'bond_dev' during its initialization is never read [clang-analyzer-deadcode.DeadStores] struct net_device *bond_dev = slave->bond->dev; ^~~~~~~~ ~~~~~~~~~~~~~~~~ drivers/net/bonding/bond_main.c:2799:21: note: Value stored to 'bond_dev' during its initialization is never read struct net_device *bond_dev = slave->bond->dev; ^~~~~~~~ ~~~~~~~~~~~~~~~~ >> drivers/net/bonding/bond_main.c:2800:21: warning: Value stored to >> 'slave_dev' during its initialization is never read >> [clang-analyzer-deadcode.DeadStores] struct net_device *slave_dev = slave->dev; ^~~~~~~~~ ~~~~~~~~~~ drivers/net/bonding/bond_main.c:2800:21: note: Value stored to 'slave_dev' during its initialization is never read struct net_device *slave_dev = slave->dev; ^~~~~~~~~ ~~~~~~~~~~ drivers/net/bonding/bond_main.c:2844:21: warning: Value stored to 'bond_dev' during its initialization is never read [clang-analyzer-deadcode.DeadStores] struct net_device *bond_dev = slave->bond->dev; ^~~~~~~~ ~~~~~~~~~~~~~~~~ drivers/net/bonding/bond_main.c:2844:21: note: Value stored to 'bond_dev' during its initialization is never read struct net_device *bond_dev = slave->bond->dev; ^~~~~~~~ ~~~~~~~~~~~~~~~~ Suppressed 3 warnings (2 in non-user code, 1 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 5 warnings generated. drivers/net/bonding/bond_3ad.c:671:14: warning: Access to field 'lag_ports' results in a dereference of a null pointer (loaded from variable 'aggregator') [clang-analyzer-core.NullDereference] for (port = aggregator->lag_ports; port; ^ drivers/net/bonding/bond_3ad.c:2335:6: note: Assuming the condition is false if (!bond_has_slaves(bond)) ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/bonding/bond_3ad.c:2335:2: note: Taking false branch if (!bond_has_slaves(bond)) ^ drivers/net/bonding/bond_3ad.c:2338:2: note: Taking false branch if (bond_agg_timer_advance(bond)) { ^ drivers/net/bonding/bond_3ad.c:2357:2: note: Loop condition is true. Entering loop body bond_for_each_slave_rcu(bond, slave, iter) { ^ include/net/bonding.h:87:2: note: expanded from macro 'bond_for_each_slave_rcu' netdev_for_each_lower_private_rcu((bond)->dev, pos, iter) ^ include/linux/netdevice.h:4576:2: note: expanded from macro 'netdev_for_each_lower_private_rcu' for (iter = &(dev)->adj_list.lower, \ ^ drivers/net/bonding/bond_3ad.c:2359:7: note: Assuming field 'slave' is non-null if (!port->slave) { ^~~~~~~~~~~~ drivers/net/bonding/bond_3ad.c:2359:3: note: Taking false branch if (!port->slave) { ^ drivers/net/bonding/bond_3ad.c:2365:3: note: Calling 'ad_rx_machine' ad_rx_machine(NULL, port); ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/bonding/bond_3ad.c:1098:6: note: 'lacpdu' is null if (lacpdu) { ^~~~~~ drivers/net/bonding/bond_3ad.c:1098:2: note: Taking false branch if (lacpdu) { ^ drivers/net/bonding/bond_3ad.c:1105:6: note: Assuming the condition is false if (port->sm_vars & AD_PORT_BEGIN) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/bonding/bond_3ad.c:1105:2: note: Taking false branch if (port->sm_vars & AD_PORT_BEGIN) { ^ drivers/net/bonding/bond_3ad.c:1109:13: note: Left side of '&&' is true } else if (!(port->sm_vars & AD_PORT_BEGIN) && !port->is_enabled) ^ drivers/net/bonding/bond_3ad.c:1109:49: note: Assuming field 'is_enabled' is true } else if (!(port->sm_vars & AD_PORT_BEGIN) && !port->is_enabled) ^~~~~~~~~~~~~~~~~ drivers/net/bonding/bond_3ad.c:1109:9: note: Taking false branch } else if (!(port->sm_vars & AD_PORT_BEGIN) && !port->is_enabled) ^ drivers/net/bonding/bond_3ad.c:1112:11: note: 'lacpdu' is null else if (lacpdu && ((port->sm_rx_state == AD_RX_EXPIRED) || ^~~~~~ drivers/net/bonding/bond_3ad.c:1112:18: note: Left side of '&&' is false else if (lacpdu && ((port->sm_rx_state == AD_RX_EXPIRED) || ^ drivers/net/bonding/bond_3ad.c:1121:7: note: Assuming field 'sm_rx_timer_counter' is 0 if (port->sm_rx_timer_counter && ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/bonding/bond_3ad.c:1121:33: note: Left side of '&&' is false if (port->sm_rx_timer_counter && ^ drivers/net/bonding/bond_3ad.c:1135:4: note: Control jumps to the 'default' case at line 1145 switch (port->sm_rx_state) { ^ drivers/net/bonding/bond_3ad.c:1146:5: note: Execution continues on line 1153 break; ^ drivers/net/bonding/bond_3ad.c:1153:28: note: 'last_state' is equal to field 'sm_rx_state' if ((port->sm_rx_state != last_state) || (lacpdu)) { ^~~~~~~~~~ drivers/net/bonding/bond_3ad.c:1153:6: note: Left side of '||' is false if ((port->sm_rx_state != last_state) || (lacpdu)) { ^ drivers/net/bonding/bond_3ad.c:1153:44: note: 'lacpdu' is null if ((port->sm_rx_state != last_state) || (lacpdu)) { ^~~~~~ drivers/net/bonding/bond_3ad.c:1153:2: note: Taking false branch if ((port->sm_rx_state != last_state) || (lacpdu)) { ^ drivers/net/bonding/bond_3ad.c:1220:1: note: Returning without writing to 'port->aggregator' } ^ drivers/net/bonding/bond_3ad.c:2365:3: note: Returning from 'ad_rx_machine' ad_rx_machine(NULL, port); vim +/slave_dev +2800 drivers/net/bonding/bond_main.c f5b2b966f032f2 Jay Vosburgh 2006-09-22 2795 1fcd5d448c59ca Hangbin Liu 2022-02-21 2796 static bool bond_handle_vlan(struct slave *slave, struct bond_vlan_tag *tags, 1fcd5d448c59ca Hangbin Liu 2022-02-21 2797 struct sk_buff *skb) c3ade5cad07f4d Jay Vosburgh 2005-06-26 2798 { e2a7420df2e013 Jarod Wilson 2019-06-07 2799 struct net_device *bond_dev = slave->bond->dev; 1fcd5d448c59ca Hangbin Liu 2022-02-21 @2800 struct net_device *slave_dev = slave->dev; 1fcd5d448c59ca Hangbin Liu 2022-02-21 2801 struct bond_vlan_tag *outer_tag = tags; 44a4085538c844 Vlad Yasevich 2014-05-16 2802 3e403a77779faf Veaceslav Falico 2014-07-17 2803 if (!tags || tags->vlan_proto == VLAN_N_VID) 1fcd5d448c59ca Hangbin Liu 2022-02-21 2804 return true; 3e403a77779faf Veaceslav Falico 2014-07-17 2805 3e403a77779faf Veaceslav Falico 2014-07-17 2806 tags++; 3e403a77779faf Veaceslav Falico 2014-07-17 2807 44a4085538c844 Vlad Yasevich 2014-05-16 2808 /* Go through all the tags backwards and add them to the packet */ 3e403a77779faf Veaceslav Falico 2014-07-17 2809 while (tags->vlan_proto != VLAN_N_VID) { 3e403a77779faf Veaceslav Falico 2014-07-17 2810 if (!tags->vlan_id) { 3e403a77779faf Veaceslav Falico 2014-07-17 2811 tags++; 44a4085538c844 Vlad Yasevich 2014-05-16 2812 continue; 3e403a77779faf Veaceslav Falico 2014-07-17 2813 } 44a4085538c844 Vlad Yasevich 2014-05-16 2814 e2a7420df2e013 Jarod Wilson 2019-06-07 2815 slave_dbg(bond_dev, slave_dev, "inner tag: proto %X vid %X\n", 3e403a77779faf Veaceslav Falico 2014-07-17 2816 ntohs(outer_tag->vlan_proto), tags->vlan_id); 62749e2cb3c4a7 Jiri Pirko 2014-11-19 2817 skb = vlan_insert_tag_set_proto(skb, tags->vlan_proto, 3e403a77779faf Veaceslav Falico 2014-07-17 2818 tags->vlan_id); c3ade5cad07f4d Jay Vosburgh 2005-06-26 2819 if (!skb) { 4873ac3c8ed3b0 dingtianhong 2014-03-25 2820 net_err_ratelimited("failed to insert inner VLAN tag\n"); 1fcd5d448c59ca Hangbin Liu 2022-02-21 2821 return false; fbd929f2dce460 dingtianhong 2014-03-25 2822 } 3e403a77779faf Veaceslav Falico 2014-07-17 2823 3e403a77779faf Veaceslav Falico 2014-07-17 2824 tags++; fbd929f2dce460 dingtianhong 2014-03-25 2825 } 44a4085538c844 Vlad Yasevich 2014-05-16 2826 /* Set the outer tag */ 3e403a77779faf Veaceslav Falico 2014-07-17 2827 if (outer_tag->vlan_id) { e2a7420df2e013 Jarod Wilson 2019-06-07 2828 slave_dbg(bond_dev, slave_dev, "outer tag: proto %X vid %X\n", 3e403a77779faf Veaceslav Falico 2014-07-17 2829 ntohs(outer_tag->vlan_proto), outer_tag->vlan_id); b4bef1b57544b1 Jiri Pirko 2014-11-19 2830 __vlan_hwaccel_put_tag(skb, outer_tag->vlan_proto, 3e403a77779faf Veaceslav Falico 2014-07-17 2831 outer_tag->vlan_id); c3ade5cad07f4d Jay Vosburgh 2005-06-26 2832 } 3e403a77779faf Veaceslav Falico 2014-07-17 2833 1fcd5d448c59ca Hangbin Liu 2022-02-21 2834 return true; 1fcd5d448c59ca Hangbin Liu 2022-02-21 2835 } 1fcd5d448c59ca Hangbin Liu 2022-02-21 2836 --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/[email protected] _______________________________________________ kbuild mailing list -- [email protected] To unsubscribe send an email to [email protected]
