:::::: 
:::::: Manual check reason: "low confidence static check warning: 
net/9p/trans_virtio.c:401:24: warning: Dereference of null pointer 
[clang-analyzer-core.NullDereference]"
:::::: 

CC: [email protected]
CC: [email protected]
BCC: [email protected]
In-Reply-To: <[email protected]>
References: <[email protected]>
TO: Al Viro <[email protected]>

Hi Al,

[FYI, it's a private test report for your RFC patch.]
[auto build test WARNING on v5.19-rc1]
[also build test WARNING on next-20220610]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    
https://github.com/intel-lab-lkp/linux/commits/Al-Viro/handling-Rerror-without-copy_from_iter_full/20220609-014338
base:    f2906aa863381afb0015a9eb7fefad885d4e5a56
:::::: branch date: 4 days ago
:::::: commit date: 4 days ago
config: x86_64-randconfig-c007 
(https://download.01.org/0day-ci/archive/20220613/[email protected]/config)
compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project 
ff4abe755279a3a47cc416ef80dbc900d9a98a19)
reproduce (this is a W=1 build):
        wget 
https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O 
~/bin/make.cross
        chmod +x ~/bin/make.cross
        # 
https://github.com/intel-lab-lkp/linux/commit/0e939f8c227af3b09fc90c8f3b6441a4bfb0b95b
        git remote add linux-review https://github.com/intel-lab-lkp/linux
        git fetch --no-tags linux-review 
Al-Viro/handling-Rerror-without-copy_from_iter_full/20220609-014338
        git checkout 0e939f8c227af3b09fc90c8f3b6441a4bfb0b95b
        # save the config file
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=x86_64 
clang-analyzer 

If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <[email protected]>


clang-analyzer warnings: (new ones prefixed by >>)
   include/linux/fortify-string.h:385:26: note: expanded from macro 'memcpy'
   #define memcpy(p, q, s)  __fortify_memcpy_chk(p, q, s,                  \
                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/fortify-string.h:378:2: note: expanded from macro 
'__fortify_memcpy_chk'
           __underlying_##op(p, q, __fortify_size);                        \
           ^~~~~~~~~~~~~~~~~
   note: expanded from here
   include/linux/fortify-string.h:45:29: note: expanded from macro 
'__underlying_memcpy'
   #define __underlying_memcpy     __builtin_memcpy
                                   ^~~~~~~~~~~~~~~~
   net/sunrpc/svcauth_unix.c:883:29: warning: Although the value stored to 
'len' is used in the enclosing expression, the value is never actually read 
from 'len' [clang-analyzer-deadcode.DeadStores]
           if (slen > UNX_NGROUPS || (len -= (slen + 2)*4) < 0)
                                      ^      ~~~~~~~~~~~~
   net/sunrpc/svcauth_unix.c:883:29: note: Although the value stored to 'len' 
is used in the enclosing expression, the value is never actually read from 'len'
           if (slen > UNX_NGROUPS || (len -= (slen + 2)*4) < 0)
                                      ^      ~~~~~~~~~~~~
   Suppressed 94 warnings (93 in non-user code, 1 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use 
-system-headers to display errors from system headers as well.
   21 warnings generated.
   drivers/leds/trigger/ledtrig-oneshot.c:43:9: warning: Call to function 
'sprintf' is insecure as it does not provide security checks introduced in the 
C11 standard. Replace with analogous functions that support length arguments or 
provides boundary checks such as 'sprintf_s' in case of C11 
[clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
           return sprintf(buf, "%u\n", oneshot_data->invert);
                  ^~~~~~~
   drivers/leds/trigger/ledtrig-oneshot.c:43:9: note: Call to function 
'sprintf' is insecure as it does not provide security checks introduced in the 
C11 standard. Replace with analogous functions that support length arguments or 
provides boundary checks such as 'sprintf_s' in case of C11
           return sprintf(buf, "%u\n", oneshot_data->invert);
                  ^~~~~~~
   drivers/leds/trigger/ledtrig-oneshot.c:73:9: warning: Call to function 
'sprintf' is insecure as it does not provide security checks introduced in the 
C11 standard. Replace with analogous functions that support length arguments or 
provides boundary checks such as 'sprintf_s' in case of C11 
[clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
           return sprintf(buf, "%lu\n", led_cdev->blink_delay_on);
                  ^~~~~~~
   drivers/leds/trigger/ledtrig-oneshot.c:73:9: note: Call to function 
'sprintf' is insecure as it does not provide security checks introduced in the 
C11 standard. Replace with analogous functions that support length arguments or 
provides boundary checks such as 'sprintf_s' in case of C11
           return sprintf(buf, "%lu\n", led_cdev->blink_delay_on);
                  ^~~~~~~
   drivers/leds/trigger/ledtrig-oneshot.c:97:9: warning: Call to function 
'sprintf' is insecure as it does not provide security checks introduced in the 
C11 standard. Replace with analogous functions that support length arguments or 
provides boundary checks such as 'sprintf_s' in case of C11 
[clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
           return sprintf(buf, "%lu\n", led_cdev->blink_delay_off);
                  ^~~~~~~
   drivers/leds/trigger/ledtrig-oneshot.c:97:9: note: Call to function 
'sprintf' is insecure as it does not provide security checks introduced in the 
C11 standard. Replace with analogous functions that support length arguments or 
provides boundary checks such as 'sprintf_s' in case of C11
           return sprintf(buf, "%lu\n", led_cdev->blink_delay_off);
                  ^~~~~~~
   Suppressed 18 warnings (18 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use 
-system-headers to display errors from system headers as well.
   38 warnings generated.
   drivers/leds/trigger/ledtrig-gpio.c:53:9: warning: Call to function 
'sprintf' is insecure as it does not provide security checks introduced in the 
C11 standard. Replace with analogous functions that support length arguments or 
provides boundary checks such as 'sprintf_s' in case of C11 
[clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
           return sprintf(buf, "%u\n", gpio_data->desired_brightness);
                  ^~~~~~~
   drivers/leds/trigger/ledtrig-gpio.c:53:9: note: Call to function 'sprintf' 
is insecure as it does not provide security checks introduced in the C11 
standard. Replace with analogous functions that support length arguments or 
provides boundary checks such as 'sprintf_s' in case of C11
           return sprintf(buf, "%u\n", gpio_data->desired_brightness);
                  ^~~~~~~
   drivers/leds/trigger/ledtrig-gpio.c:63:8: warning: Call to function 'sscanf' 
is insecure as it does not provide security checks introduced in the C11 
standard. Replace with analogous functions that support length arguments or 
provides boundary checks such as 'sscanf_s' in case of C11 
[clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
           ret = sscanf(buf, "%u", &desired_brightness);
                 ^~~~~~
   drivers/leds/trigger/ledtrig-gpio.c:63:8: note: Call to function 'sscanf' is 
insecure as it does not provide security checks introduced in the C11 standard. 
Replace with analogous functions that support length arguments or provides 
boundary checks such as 'sscanf_s' in case of C11
           ret = sscanf(buf, "%u", &desired_brightness);
                 ^~~~~~
   drivers/leds/trigger/ledtrig-gpio.c:81:9: warning: Call to function 
'sprintf' is insecure as it does not provide security checks introduced in the 
C11 standard. Replace with analogous functions that support length arguments or 
provides boundary checks such as 'sprintf_s' in case of C11 
[clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
           return sprintf(buf, "%u\n", gpio_data->inverted);
                  ^~~~~~~
   drivers/leds/trigger/ledtrig-gpio.c:81:9: note: Call to function 'sprintf' 
is insecure as it does not provide security checks introduced in the C11 
standard. Replace with analogous functions that support length arguments or 
provides boundary checks such as 'sprintf_s' in case of C11
           return sprintf(buf, "%u\n", gpio_data->inverted);
                  ^~~~~~~
   drivers/leds/trigger/ledtrig-gpio.c:115:9: warning: Call to function 
'sprintf' is insecure as it does not provide security checks introduced in the 
C11 standard. Replace with analogous functions that support length arguments or 
provides boundary checks such as 'sprintf_s' in case of C11 
[clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
           return sprintf(buf, "%u\n", gpio_data->gpio);
                  ^~~~~~~
   drivers/leds/trigger/ledtrig-gpio.c:115:9: note: Call to function 'sprintf' 
is insecure as it does not provide security checks introduced in the C11 
standard. Replace with analogous functions that support length arguments or 
provides boundary checks such as 'sprintf_s' in case of C11
           return sprintf(buf, "%u\n", gpio_data->gpio);
                  ^~~~~~~
   drivers/leds/trigger/ledtrig-gpio.c:126:8: warning: Call to function 
'sscanf' is insecure as it does not provide security checks introduced in the 
C11 standard. Replace with analogous functions that support length arguments or 
provides boundary checks such as 'sscanf_s' in case of C11 
[clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
           ret = sscanf(buf, "%u", &gpio);
                 ^~~~~~
   drivers/leds/trigger/ledtrig-gpio.c:126:8: note: Call to function 'sscanf' 
is insecure as it does not provide security checks introduced in the C11 
standard. Replace with analogous functions that support length arguments or 
provides boundary checks such as 'sscanf_s' in case of C11
           ret = sscanf(buf, "%u", &gpio);
                 ^~~~~~
   Suppressed 33 warnings (33 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use 
-system-headers to display errors from system headers as well.
   71 warnings generated.
   net/wireless/lib80211.c:51:2: warning: Call to function 'memset' is insecure 
as it does not provide security checks introduced in the C11 standard. Replace 
with analogous functions that support length arguments or provides boundary 
checks such as 'memset_s' in case of C11 
[clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
           memset(info, 0, sizeof(*info));
           ^
   include/linux/fortify-string.h:288:25: note: expanded from macro 'memset'
   #define memset(p, c, s) __fortify_memset_chk(p, c, s,                   \
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/fortify-string.h:281:2: note: expanded from macro 
'__fortify_memset_chk'
           __underlying_memset(p, c, __fortify_size);                      \
           ^~~~~~~~~~~~~~~~~~~
   include/linux/fortify-string.h:47:29: note: expanded from macro 
'__underlying_memset'
   #define __underlying_memset     __builtin_memset
                                   ^~~~~~~~~~~~~~~~
   net/wireless/lib80211.c:51:2: note: Call to function 'memset' is insecure as 
it does not provide security checks introduced in the C11 standard. Replace 
with analogous functions that support length arguments or provides boundary 
checks such as 'memset_s' in case of C11
           memset(info, 0, sizeof(*info));
           ^
   include/linux/fortify-string.h:288:25: note: expanded from macro 'memset'
   #define memset(p, c, s) __fortify_memset_chk(p, c, s,                   \
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/fortify-string.h:281:2: note: expanded from macro 
'__fortify_memset_chk'
           __underlying_memset(p, c, __fortify_size);                      \
           ^~~~~~~~~~~~~~~~~~~
   include/linux/fortify-string.h:47:29: note: expanded from macro 
'__underlying_memset'
   #define __underlying_memset     __builtin_memset
                                   ^~~~~~~~~~~~~~~~
   Suppressed 70 warnings (70 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use 
-system-headers to display errors from system headers as well.
   86 warnings generated.
>> net/9p/trans_virtio.c:401:24: warning: Dereference of null pointer 
>> [clang-analyzer-core.NullDereference]
                   memcpy_from_page(to, *pages++, offs, n);
                                        ^
   net/9p/trans_virtio.c:435:2: note: Taking false branch
           p9_debug(P9_DEBUG_TRANS, "virtio request\n");
           ^
   include/net/9p/9p.h:56:2: note: expanded from macro 'p9_debug'
           no_printk(fmt, ##__VA_ARGS__)
           ^
   include/linux/printk.h:130:2: note: expanded from macro 'no_printk'
           if (0)                                          \
           ^
   net/9p/trans_virtio.c:437:6: note: Assuming 'uodata' is null
           if (uodata) {
               ^~~~~~
   net/9p/trans_virtio.c:437:2: note: Taking false branch
           if (uodata) {
           ^
   net/9p/trans_virtio.c:457:13: note: Assuming 'uidata' is non-null
           } else if (uidata) {
                      ^~~~~~
   net/9p/trans_virtio.c:457:9: note: Taking true branch
           } else if (uidata) {
                  ^
   net/9p/trans_virtio.c:460:7: note: Assuming 'n' is >= 0
                   if (n < 0) {
                       ^~~~~
   net/9p/trans_virtio.c:460:3: note: Taking false branch
                   if (n < 0) {
                   ^
   net/9p/trans_virtio.c:465:7: note: Assuming 'n' is equal to 'inlen'
                   if (n != inlen) {
                       ^~~~~~~~~~
   net/9p/trans_virtio.c:465:3: note: Taking false branch
                   if (n != inlen) {
                   ^
   net/9p/trans_virtio.c:473:2: note: Loop condition is false.  Exiting loop
           spin_lock_irqsave(&chan->lock, flags);
           ^
   include/linux/spinlock.h:379:2: note: expanded from macro 'spin_lock_irqsave'
           raw_spin_lock_irqsave(spinlock_check(lock), flags);     \
           ^
   include/linux/spinlock.h:240:2: note: expanded from macro 
'raw_spin_lock_irqsave'
           do {                                            \
           ^
   net/9p/trans_virtio.c:473:2: note: Loop condition is false.  Exiting loop
           spin_lock_irqsave(&chan->lock, flags);
           ^
   include/linux/spinlock.h:377:43: note: expanded from macro 
'spin_lock_irqsave'
   #define spin_lock_irqsave(lock, flags)                          \
                                                                   ^
   net/9p/trans_virtio.c:481:6: note: Assuming 'out' is 0
           if (out)
               ^~~
   net/9p/trans_virtio.c:481:2: note: Taking false branch
           if (out)
           ^
   net/9p/trans_virtio.c:484:6: note: 'out_pages' is null
           if (out_pages) {
               ^~~~~~~~~
   net/9p/trans_virtio.c:484:2: note: Taking false branch
           if (out_pages) {
           ^
   net/9p/trans_virtio.c:499:6: note: Assuming 'in' is 0
           if (in)
               ^~
   net/9p/trans_virtio.c:499:2: note: Taking false branch
           if (in)
           ^
   net/9p/trans_virtio.c:502:6: note: Assuming 'in_pages' is null
           if (in_pages) {
               ^~~~~~~~
   net/9p/trans_virtio.c:502:2: note: Taking false branch
           if (in_pages) {
           ^
   net/9p/trans_virtio.c:508:2: note: Taking false branch
           BUG_ON(out_sgs + in_sgs > ARRAY_SIZE(sgs));
           ^
   include/asm-generic/bug.h:71:32: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                  ^
   net/9p/trans_virtio.c:508:2: note: Loop condition is false.  Exiting loop
           BUG_ON(out_sgs + in_sgs > ARRAY_SIZE(sgs));
           ^
   include/asm-generic/bug.h:71:27: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                             ^
   net/9p/trans_virtio.c:511:6: note: Assuming 'err' is >= 0
           if (err < 0) {
               ^~~~~~~
   net/9p/trans_virtio.c:511:2: note: Taking false branch
           if (err < 0) {
           ^
   net/9p/trans_virtio.c:533:2: note: Taking false branch
           p9_debug(P9_DEBUG_TRANS, "virtio request kicked\n");
           ^
   include/net/9p/9p.h:56:2: note: expanded from macro 'p9_debug'
           no_printk(fmt, ##__VA_ARGS__)
           ^
   include/linux/printk.h:130:2: note: expanded from macro 'no_printk'
           if (0)                                          \
           ^
   net/9p/trans_virtio.c:534:8: note: Loop condition is false.  Exiting loop
           err = wait_event_killable(req->wq, req->status >= REQ_STATUS_RCVD);
                 ^
   include/linux/wait.h:928:2: note: expanded from macro 'wait_event_killable'
           might_sleep();                                                       
   \
           ^
   include/linux/kernel.h:143:2: note: expanded from macro 'might_sleep'
           do { __might_sleep(__FILE__, __LINE__); might_resched(); } while (0)
           ^
   net/9p/trans_virtio.c:534:37: note: Assuming field 'status' is >= 
REQ_STATUS_RCVD
           err = wait_event_killable(req->wq, req->status >= REQ_STATUS_RCVD);
                                              ^
   include/linux/wait.h:929:8: note: expanded from macro 'wait_event_killable'
           if (!(condition))                                                    
   \
                 ^~~~~~~~~
   net/9p/trans_virtio.c:534:8: note: Taking false branch
           err = wait_event_killable(req->wq, req->status >= REQ_STATUS_RCVD);
                 ^
   include/linux/wait.h:929:2: note: expanded from macro 'wait_event_killable'
           if (!(condition))                                                    
   \
           ^
   net/9p/trans_virtio.c:536:6: note: Assuming field 'status' is equal to 
REQ_STATUS_RCVD
           if (req->status == REQ_STATUS_RCVD &&
               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   net/9p/trans_virtio.c:536:6: note: Left side of '&&' is true
   net/9p/trans_virtio.c:537:15: note: Assuming the condition is true
               unlikely(req->rc.sdata[4] == P9_RERROR))
                        ^
   include/linux/compiler.h:78:42: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                               ^
   net/9p/trans_virtio.c:536:2: note: Taking true branch
           if (req->status == REQ_STATUS_RCVD &&
           ^
   net/9p/trans_virtio.c:538:3: note: Calling 'handle_rerror'
                   handle_rerror(req, in_hdr_len, offs, in_pages);
                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   net/9p/trans_virtio.c:387:6: note: Assuming 'in_hdr_len' is <= field 'size'
           if (req->rc.size < in_hdr_len)
               ^~~~~~~~~~~~~~~~~~~~~~~~~
   net/9p/trans_virtio.c:387:2: note: Taking false branch
           if (req->rc.size < in_hdr_len)
           ^
   net/9p/trans_virtio.c:394:15: note: Assuming field 'size' is <= 4096
           if (unlikely(req->rc.size > P9_ZC_HDR_SZ))
                        ^
   include/linux/compiler.h:78:42: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                               ^
   net/9p/trans_virtio.c:394:2: note: Taking false branch
           if (unlikely(req->rc.size > P9_ZC_HDR_SZ))
           ^
   net/9p/trans_virtio.c:400:6: note: Assuming 'size' is > 'n'
           if (size > n) {
               ^~~~~~~~
   net/9p/trans_virtio.c:400:2: note: Taking true branch
           if (size > n) {
           ^
   net/9p/trans_virtio.c:401:25: note: Null pointer value stored to 'pages'
                   memcpy_from_page(to, *pages++, offs, n);
                                         ^~~~~~~
   net/9p/trans_virtio.c:401:24: note: Dereference of null pointer
                   memcpy_from_page(to, *pages++, offs, n);
                                        ^~~~~~~~
>> net/9p/trans_virtio.c:406:23: warning: Dereference of null pointer (loaded 
>> from variable 'pages') [clang-analyzer-core.NullDereference]
           memcpy_from_page(to, *pages, offs, size);
                                ^
   net/9p/trans_virtio.c:435:2: note: Taking false branch
           p9_debug(P9_DEBUG_TRANS, "virtio request\n");
           ^
   include/net/9p/9p.h:56:2: note: expanded from macro 'p9_debug'
           no_printk(fmt, ##__VA_ARGS__)
           ^
   include/linux/printk.h:130:2: note: expanded from macro 'no_printk'
           if (0)                                          \
           ^
   net/9p/trans_virtio.c:437:6: note: Assuming 'uodata' is null
           if (uodata) {
               ^~~~~~
   net/9p/trans_virtio.c:437:2: note: Taking false branch
           if (uodata) {
           ^
   net/9p/trans_virtio.c:457:13: note: Assuming 'uidata' is non-null
           } else if (uidata) {
                      ^~~~~~
   net/9p/trans_virtio.c:457:9: note: Taking true branch
           } else if (uidata) {
                  ^
   net/9p/trans_virtio.c:458:11: note: Value assigned to 'in_pages'
                   int n = p9_get_mapped_pages(chan, &in_pages, uidata,
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   net/9p/trans_virtio.c:460:7: note: Assuming 'n' is >= 0
                   if (n < 0) {
                       ^~~~~
   net/9p/trans_virtio.c:460:3: note: Taking false branch
                   if (n < 0) {
                   ^
   net/9p/trans_virtio.c:465:7: note: Assuming 'n' is equal to 'inlen'
                   if (n != inlen) {
                       ^~~~~~~~~~
   net/9p/trans_virtio.c:465:3: note: Taking false branch
                   if (n != inlen) {
                   ^
   net/9p/trans_virtio.c:473:2: note: Loop condition is false.  Exiting loop
           spin_lock_irqsave(&chan->lock, flags);
           ^
   include/linux/spinlock.h:379:2: note: expanded from macro 'spin_lock_irqsave'
           raw_spin_lock_irqsave(spinlock_check(lock), flags);     \
           ^
   include/linux/spinlock.h:240:2: note: expanded from macro 
'raw_spin_lock_irqsave'
           do {                                            \
           ^
   net/9p/trans_virtio.c:473:2: note: Loop condition is false.  Exiting loop
           spin_lock_irqsave(&chan->lock, flags);
           ^
   include/linux/spinlock.h:377:43: note: expanded from macro 
'spin_lock_irqsave'
   #define spin_lock_irqsave(lock, flags)                          \
                                                                   ^
   net/9p/trans_virtio.c:481:6: note: Assuming 'out' is 0
           if (out)
               ^~~
   net/9p/trans_virtio.c:481:2: note: Taking false branch
           if (out)
           ^
   net/9p/trans_virtio.c:484:6: note: 'out_pages' is null
           if (out_pages) {
               ^~~~~~~~~
   net/9p/trans_virtio.c:484:2: note: Taking false branch
           if (out_pages) {
           ^
   net/9p/trans_virtio.c:499:6: note: Assuming 'in' is 0
           if (in)
               ^~
   net/9p/trans_virtio.c:499:2: note: Taking false branch
           if (in)
           ^
   net/9p/trans_virtio.c:502:6: note: Assuming 'in_pages' is null
           if (in_pages) {
               ^~~~~~~~
   net/9p/trans_virtio.c:502:2: note: Taking false branch
           if (in_pages) {
           ^
   net/9p/trans_virtio.c:508:2: note: Taking false branch
           BUG_ON(out_sgs + in_sgs > ARRAY_SIZE(sgs));
           ^
   include/asm-generic/bug.h:71:32: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                  ^
   net/9p/trans_virtio.c:508:2: note: Loop condition is false.  Exiting loop
           BUG_ON(out_sgs + in_sgs > ARRAY_SIZE(sgs));
           ^
   include/asm-generic/bug.h:71:27: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                             ^
   net/9p/trans_virtio.c:511:6: note: Assuming 'err' is >= 0
           if (err < 0) {
               ^~~~~~~
   net/9p/trans_virtio.c:511:2: note: Taking false branch
           if (err < 0) {
           ^
   net/9p/trans_virtio.c:533:2: note: Taking false branch
           p9_debug(P9_DEBUG_TRANS, "virtio request kicked\n");
           ^
   include/net/9p/9p.h:56:2: note: expanded from macro 'p9_debug'
           no_printk(fmt, ##__VA_ARGS__)

vim +401 net/9p/trans_virtio.c

4038866dab4e46 Venkateswararao Jujjuri (JV  2011-01-28  379) 
0e939f8c227af3 Al Viro                      2022-06-08  380  static void 
handle_rerror(struct p9_req_t *req, int in_hdr_len,
0e939f8c227af3 Al Viro                      2022-06-08  381                     
  size_t offs, struct page **pages)
0e939f8c227af3 Al Viro                      2022-06-08  382  {
0e939f8c227af3 Al Viro                      2022-06-08  383     unsigned size, 
n;
0e939f8c227af3 Al Viro                      2022-06-08  384     void *to = 
req->rc.sdata + in_hdr_len;
0e939f8c227af3 Al Viro                      2022-06-08  385  
0e939f8c227af3 Al Viro                      2022-06-08  386     // Fits 
entirely into the static data?  Nothing to do.
0e939f8c227af3 Al Viro                      2022-06-08  387     if 
(req->rc.size < in_hdr_len)
0e939f8c227af3 Al Viro                      2022-06-08  388             return;
0e939f8c227af3 Al Viro                      2022-06-08  389  
0e939f8c227af3 Al Viro                      2022-06-08  390     // Really long 
error message?  Tough, truncate the reply.  Might get
0e939f8c227af3 Al Viro                      2022-06-08  391     // rejected (we 
can't be arsed to adjust the size encoded in header,
0e939f8c227af3 Al Viro                      2022-06-08  392     // or string 
size for that matter), but it wouldn't be anything valid
0e939f8c227af3 Al Viro                      2022-06-08  393     // anyway.
0e939f8c227af3 Al Viro                      2022-06-08  394     if 
(unlikely(req->rc.size > P9_ZC_HDR_SZ))
0e939f8c227af3 Al Viro                      2022-06-08  395             
req->rc.size = P9_ZC_HDR_SZ;
0e939f8c227af3 Al Viro                      2022-06-08  396  
0e939f8c227af3 Al Viro                      2022-06-08  397     // data won't 
span more than two pages
0e939f8c227af3 Al Viro                      2022-06-08  398     size = 
req->rc.size - in_hdr_len;
0e939f8c227af3 Al Viro                      2022-06-08  399     n = PAGE_SIZE - 
offs;
0e939f8c227af3 Al Viro                      2022-06-08  400     if (size > n) {
0e939f8c227af3 Al Viro                      2022-06-08 @401             
memcpy_from_page(to, *pages++, offs, n);
0e939f8c227af3 Al Viro                      2022-06-08  402             offs = 
0;
0e939f8c227af3 Al Viro                      2022-06-08  403             to += n;
0e939f8c227af3 Al Viro                      2022-06-08  404             size -= 
n;
0e939f8c227af3 Al Viro                      2022-06-08  405     }
0e939f8c227af3 Al Viro                      2022-06-08 @406     
memcpy_from_page(to, *pages, offs, size);
0e939f8c227af3 Al Viro                      2022-06-08  407  }
0e939f8c227af3 Al Viro                      2022-06-08  408  

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp
_______________________________________________
kbuild mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to