:::::: :::::: Manual check reason: "low confidence static check warning: drivers/media/usb/uvc/uvc_ctrl.c:846:9: warning: Null pointer passed as 2nd argument to memory comparison function [clang-analyzer-unix.cstring.NullArg]" ::::::
CC: [email protected] CC: [email protected] BCC: [email protected] CC: [email protected] TO: Ricardo Ribalda <[email protected]> CC: Mauro Carvalho Chehab <[email protected]> CC: [email protected] CC: Laurent Pinchart <[email protected]> tree: https://git.linuxtv.org/mchehab/experimental.git master head: 8bd1dbf8d580c425605fb8936309a4e9745a7a95 commit: 86f7ef77315687df144042762325c53d9a3a28c9 [366/438] media: uvcvideo: Add support for per-device control mapping overrides :::::: branch date: 8 days ago :::::: commit date: 9 days ago config: arm-randconfig-c002-20220718 (https://download.01.org/0day-ci/archive/20220725/[email protected]/config) compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project dd5635541cd7bbd62cd59b6694dfb759b6e9a0d8) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # install arm cross compiling tool for clang build # apt-get install binutils-arm-linux-gnueabi git remote add mchehab-experimental https://git.linuxtv.org/mchehab/experimental.git git fetch --no-tags mchehab-experimental master git checkout 86f7ef77315687df144042762325c53d9a3a28c9 # save the config file COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm clang-analyzer If you fix the issue, kindly add following tag where applicable Reported-by: kernel test robot <[email protected]> clang-analyzer warnings: (new ones prefixed by >>) if (crc != buf[i + 2]) { ^~~~~~~~~~~~~~~~~ drivers/iio/chemical/scd30_i2c.c:99:3: note: Taking false branch if (crc != buf[i + 2]) { ^ drivers/iio/chemical/scd30_i2c.c:104:10: note: Dereference of null pointer *rsp++ = buf[i]; ~~~~~~~^~~~~~~~ Suppressed 41 warnings (41 in non-user code). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 46 warnings generated. drivers/media/tuners/tua9001.c:148:21: warning: Value stored to 'client' during its initialization is never read [clang-analyzer-deadcode.DeadStores] struct i2c_client *client = dev->client; ^~~~~~ ~~~~~~~~~~~ drivers/media/tuners/tua9001.c:148:21: note: Value stored to 'client' during its initialization is never read struct i2c_client *client = dev->client; ^~~~~~ ~~~~~~~~~~~ drivers/media/tuners/tua9001.c:217:2: warning: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling] memcpy(&fe->ops.tuner_ops, &tua9001_tuner_ops, ^~~~~~ drivers/media/tuners/tua9001.c:217:2: note: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11 memcpy(&fe->ops.tuner_ops, &tua9001_tuner_ops, ^~~~~~ Suppressed 44 warnings (43 in non-user code, 1 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 53 warnings generated. drivers/media/tuners/xc2028.c:287:2: warning: Call to function 'memset' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memset_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling] memset(&priv->cur_fw, 0, sizeof(priv->cur_fw)); ^~~~~~ drivers/media/tuners/xc2028.c:287:2: note: Call to function 'memset' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memset_s' in case of C11 memset(&priv->cur_fw, 0, sizeof(priv->cur_fw)); ^~~~~~ drivers/media/tuners/xc2028.c:321:2: warning: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling] memcpy(name, p, sizeof(name) - 1); ^~~~~~ drivers/media/tuners/xc2028.c:321:2: note: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11 memcpy(name, p, sizeof(name) - 1); ^~~~~~ drivers/media/tuners/xc2028.c:631:4: warning: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling] memcpy(buf + 1, p, len); ^~~~~~ drivers/media/tuners/xc2028.c:631:4: note: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11 memcpy(buf + 1, p, len); ^~~~~~ drivers/media/tuners/xc2028.c:769:2: warning: Call to function 'memset' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memset_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling] memset(&priv->cur_fw, 0, sizeof(priv->cur_fw)); ^~~~~~ drivers/media/tuners/xc2028.c:769:2: note: Call to function 'memset' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memset_s' in case of C11 memset(&priv->cur_fw, 0, sizeof(priv->cur_fw)); ^~~~~~ drivers/media/tuners/xc2028.c:1037:3: warning: Value stored to 'rc' is never read [clang-analyzer-deadcode.DeadStores] rc = send_seq(priv, {0x00, 0x00}); ^ drivers/media/tuners/xc2028.c:1037:3: note: Value stored to 'rc' is never read drivers/media/tuners/xc2028.c:1396:2: warning: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling] memcpy(&priv->ctrl, p, sizeof(priv->ctrl)); ^~~~~~ drivers/media/tuners/xc2028.c:1396:2: note: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11 memcpy(&priv->ctrl, p, sizeof(priv->ctrl)); ^~~~~~ drivers/media/tuners/xc2028.c:1497:2: warning: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling] memcpy(&fe->ops.tuner_ops, &xc2028_dvb_tuner_ops, ^~~~~~ drivers/media/tuners/xc2028.c:1497:2: note: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11 memcpy(&fe->ops.tuner_ops, &xc2028_dvb_tuner_ops, ^~~~~~ Suppressed 46 warnings (44 in non-user code, 2 with check filters). Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well. 61 warnings generated. drivers/media/usb/uvc/uvc_ctrl.c:832:37: warning: The result of the left shift is undefined because the left operand is negative [clang-analyzer-core.UndefinedBinaryOperatorResult] *data = (*data & ~mask) | ((value << offset) & mask); ~~~~~ ^ drivers/media/usb/uvc/uvc_ctrl.c:824:6: note: Assuming field 'v4l2_type' is equal to V4L2_CTRL_TYPE_BUTTON if (mapping->v4l2_type == V4L2_CTRL_TYPE_BUTTON) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/media/usb/uvc/uvc_ctrl.c:824:2: note: Taking true branch if (mapping->v4l2_type == V4L2_CTRL_TYPE_BUTTON) ^ drivers/media/usb/uvc/uvc_ctrl.c:830:9: note: Assuming 'bits' is > 0 for (; bits > 0; data++) { ^~~~~~~~ drivers/media/usb/uvc/uvc_ctrl.c:830:2: note: Loop condition is true. Entering loop body for (; bits > 0; data++) { ^ drivers/media/usb/uvc/uvc_ctrl.c:833:13: note: Assuming 'offset' is 0 value >>= offset ? offset : 8; ^~~~~~ drivers/media/usb/uvc/uvc_ctrl.c:833:13: note: '?' condition is false drivers/media/usb/uvc/uvc_ctrl.c:833:3: note: The value -1 is assigned to 'value' value >>= offset ? offset : 8; ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/media/usb/uvc/uvc_ctrl.c:830:9: note: Assuming 'bits' is > 0 for (; bits > 0; data++) { ^~~~~~~~ drivers/media/usb/uvc/uvc_ctrl.c:830:2: note: Loop condition is true. Entering loop body for (; bits > 0; data++) { ^ drivers/media/usb/uvc/uvc_ctrl.c:832:37: note: The result of the left shift is undefined because the left operand is negative *data = (*data & ~mask) | ((value << offset) & mask); ~~~~~ ^ >> drivers/media/usb/uvc/uvc_ctrl.c:846:9: warning: Null pointer passed as 2nd >> argument to memory comparison function [clang-analyzer-unix.cstring.NullArg] return memcmp(entity->guid, guid, sizeof(entity->guid)) == 0; ^ drivers/media/usb/uvc/uvc_ctrl.c:2557:2: note: Loop condition is false. Exiting loop INIT_WORK(&dev->async_ctrl.work, uvc_ctrl_status_event_work); ^ include/linux/workqueue.h:245:2: note: expanded from macro 'INIT_WORK' __INIT_WORK((_work), (_func), 0) ^ include/linux/workqueue.h:236:2: note: expanded from macro '__INIT_WORK' do { \ ^ drivers/media/usb/uvc/uvc_ctrl.c:2559:2: note: Loop condition is true. Entering loop body list_for_each_entry(chain, &dev->chains, list) { ^ include/linux/list.h:674:2: note: expanded from macro 'list_for_each_entry' for (pos = list_first_entry(head, typeof(*pos), member); \ ^ drivers/media/usb/uvc/uvc_ctrl.c:2560:9: note: Calling 'uvc_ctrl_init_chain' ret = uvc_ctrl_init_chain(chain); ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/media/usb/uvc/uvc_ctrl.c:2502:2: note: Loop condition is true. Entering loop body list_for_each_entry(entity, &chain->entities, chain) { ^ include/linux/list.h:674:2: note: expanded from macro 'list_for_each_entry' for (pos = list_first_entry(head, typeof(*pos), member); \ ^ drivers/media/usb/uvc/uvc_ctrl.c:2507:7: note: Assuming the condition is false if (UVC_ENTITY_TYPE(entity) == UVC_VC_EXTENSION_UNIT) { ^ drivers/media/usb/uvc/uvcvideo.h:31:34: note: expanded from macro 'UVC_ENTITY_TYPE' #define UVC_ENTITY_TYPE(entity) ((entity)->type & 0x7fff) ^ drivers/media/usb/uvc/uvc_ctrl.c:2507:3: note: Taking false branch if (UVC_ENTITY_TYPE(entity) == UVC_VC_EXTENSION_UNIT) { ^ drivers/media/usb/uvc/uvc_ctrl.c:2510:14: note: Assuming the condition is false } else if (UVC_ENTITY_TYPE(entity) == UVC_VC_PROCESSING_UNIT) { ^ drivers/media/usb/uvc/uvcvideo.h:31:34: note: expanded from macro 'UVC_ENTITY_TYPE' #define UVC_ENTITY_TYPE(entity) ((entity)->type & 0x7fff) ^ drivers/media/usb/uvc/uvc_ctrl.c:2510:10: note: Taking false branch } else if (UVC_ENTITY_TYPE(entity) == UVC_VC_PROCESSING_UNIT) { ^ drivers/media/usb/uvc/uvc_ctrl.c:2513:14: note: Assuming the condition is false } else if (UVC_ENTITY_TYPE(entity) == UVC_ITT_CAMERA) { ^ drivers/media/usb/uvc/uvcvideo.h:31:34: note: expanded from macro 'UVC_ENTITY_TYPE' #define UVC_ENTITY_TYPE(entity) ((entity)->type & 0x7fff) ^ drivers/media/usb/uvc/uvc_ctrl.c:2513:10: note: Taking false branch } else if (UVC_ENTITY_TYPE(entity) == UVC_ITT_CAMERA) { ^ drivers/media/usb/uvc/uvc_ctrl.c:2516:14: note: Assuming the condition is true } else if (UVC_ENTITY_TYPE(entity) == UVC_EXT_GPIO_UNIT) { ^ drivers/media/usb/uvc/uvcvideo.h:31:34: note: expanded from macro 'UVC_ENTITY_TYPE' #define UVC_ENTITY_TYPE(entity) ((entity)->type & 0x7fff) ^ drivers/media/usb/uvc/uvc_ctrl.c:2516:10: note: Taking true branch } else if (UVC_ENTITY_TYPE(entity) == UVC_EXT_GPIO_UNIT) { ^ drivers/media/usb/uvc/uvc_ctrl.c:2526:7: note: Assuming 'ncontrols' is not equal to 0 if (ncontrols == 0) ^~~~~~~~~~~~~~ drivers/media/usb/uvc/uvc_ctrl.c:2526:3: note: Taking false branch if (ncontrols == 0) ^ drivers/media/usb/uvc/uvc_ctrl.c:2531:7: note: Assuming field 'controls' is not equal to NULL if (entity->controls == NULL) ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/media/usb/uvc/uvc_ctrl.c:2531:3: note: Taking false branch if (entity->controls == NULL) ^ drivers/media/usb/uvc/uvc_ctrl.c:2537:15: note: Assuming the condition is true for (i = 0; i < bControlSize * 8; ++i) { ^~~~~~~~~~~~~~~~~~~~ drivers/media/usb/uvc/uvc_ctrl.c:2537:3: note: Loop condition is true. Entering loop body for (i = 0; i < bControlSize * 8; ++i) { ^ drivers/media/usb/uvc/uvc_ctrl.c:2538:8: note: Assuming the condition is false if (uvc_test_bit(bmControls, i) == 0) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/media/usb/uvc/uvc_ctrl.c:2538:4: note: Taking false branch if (uvc_test_bit(bmControls, i) == 0) ^ drivers/media/usb/uvc/uvc_ctrl.c:2544:4: note: Calling 'uvc_ctrl_init_ctrl' uvc_ctrl_init_ctrl(chain, ctrl); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/media/usb/uvc/uvc_ctrl.c:2426:2: note: Taking false branch if (UVC_ENTITY_TYPE(ctrl->entity) == UVC_VC_EXTENSION_UNIT) ^ drivers/media/usb/uvc/uvc_ctrl.c:2429:2: note: Loop condition is true. Entering loop body for (; info < iend; ++info) { ^ drivers/media/usb/uvc/uvc_ctrl.c:2430:7: note: Left side of '&&' is true if (uvc_entity_match_guid(ctrl->entity, info->entity) && ^ drivers/media/usb/uvc/uvc_ctrl.c:2431:7: note: Assuming 'ctrl->index' is equal to 'info->index' ctrl->index == info->index) { vim +846 drivers/media/usb/uvc/uvc_ctrl.c c0efd232929c2c drivers/media/video/uvc/uvc_ctrl.c Laurent Pinchart 2008-06-30 838 c0efd232929c2c drivers/media/video/uvc/uvc_ctrl.c Laurent Pinchart 2008-06-30 839 /* ------------------------------------------------------------------------ c0efd232929c2c drivers/media/video/uvc/uvc_ctrl.c Laurent Pinchart 2008-06-30 840 * Terminal and unit management c0efd232929c2c drivers/media/video/uvc/uvc_ctrl.c Laurent Pinchart 2008-06-30 841 */ c0efd232929c2c drivers/media/video/uvc/uvc_ctrl.c Laurent Pinchart 2008-06-30 842 f9d81df9b8d77f drivers/media/video/uvc/uvc_ctrl.c Laurent Pinchart 2010-09-17 843 static int uvc_entity_match_guid(const struct uvc_entity *entity, 2c6b222cee2d68 drivers/media/usb/uvc/uvc_ctrl.c Laurent Pinchart 2018-01-16 844 const u8 guid[16]) c0efd232929c2c drivers/media/video/uvc/uvc_ctrl.c Laurent Pinchart 2008-06-30 845 { 351509c604dcb0 drivers/media/usb/uvc/uvc_ctrl.c Ricardo Ribalda 2020-12-23 @846 return memcmp(entity->guid, guid, sizeof(entity->guid)) == 0; c0efd232929c2c drivers/media/video/uvc/uvc_ctrl.c Laurent Pinchart 2008-06-30 847 } c0efd232929c2c drivers/media/video/uvc/uvc_ctrl.c Laurent Pinchart 2008-06-30 848 :::::: The code at line 846 was first introduced by commit :::::: 351509c604dcb065305a165d7552058c2cbc447d media: uvcvideo: Move guid to entity :::::: TO: Ricardo Ribalda <[email protected]> :::::: CC: Mauro Carvalho Chehab <[email protected]> -- 0-DAY CI Kernel Test Service https://01.org/lkp _______________________________________________ kbuild mailing list -- [email protected] To unsubscribe send an email to [email protected]
