:::::: :::::: Manual check reason: "low confidence static check warning: drivers/of/irq.c:619:2: warning: Use of memory after it is freed [clang-analyzer-unix.Malloc]" ::::::
BCC: [email protected] CC: [email protected] CC: [email protected] CC: [email protected] TO: Samuel Holland <[email protected]> CC: Rob Herring <[email protected]> tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: 80e78fcce86de0288793a0ef0f6acf37656ee4cf commit: e91033621d56e055803c4c4ba507fbbb2d145a7f of/irq: Use interrupts-extended to find parent date: 5 months ago :::::: branch date: 17 hours ago :::::: commit date: 5 months ago config: arm-randconfig-c002-20220904 (https://download.01.org/0day-ci/archive/20220912/[email protected]/config) compiler: clang version 16.0.0 (https://github.com/llvm/llvm-project c55b41d5199d2394dd6cdb8f52180d8b81d809d4) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # install arm cross compiling tool for clang build # apt-get install binutils-arm-linux-gnueabi # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e91033621d56e055803c4c4ba507fbbb2d145a7f git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git git fetch --no-tags linus master git checkout e91033621d56e055803c4c4ba507fbbb2d145a7f # save the config file COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm clang-analyzer If you fix the issue, kindly add following tag where applicable Reported-by: kernel test robot <[email protected]> clang_analyzer warnings: (new ones prefixed by >>) ^ drivers/of/irq.c:608:10: note: Taking false branch desc = list_first_entry_or_null(&intc_parent_list, ^ include/linux/list.h:554:28: note: expanded from macro 'list_first_entry_or_null' struct list_head *pos__ = READ_ONCE(head__->next); \ ^ include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE' compiletime_assert_rwonce_type(x); \ ^ include/asm-generic/rwonce.h:36:2: note: expanded from macro 'compiletime_assert_rwonce_type' compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \ ^ include/linux/compiler_types.h:352:2: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:340:2: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ^ include/linux/compiler_types.h:332:3: note: expanded from macro '__compiletime_assert' if (!(condition)) \ ^ drivers/of/irq.c:608:10: note: Loop condition is false. Exiting loop desc = list_first_entry_or_null(&intc_parent_list, ^ include/linux/list.h:554:28: note: expanded from macro 'list_first_entry_or_null' struct list_head *pos__ = READ_ONCE(head__->next); \ ^ include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE' compiletime_assert_rwonce_type(x); \ ^ include/asm-generic/rwonce.h:36:2: note: expanded from macro 'compiletime_assert_rwonce_type' compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \ ^ include/linux/compiler_types.h:352:2: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:340:2: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ^ include/linux/compiler_types.h:324:2: note: expanded from macro '__compiletime_assert' do { \ ^ drivers/of/irq.c:608:10: note: 'pos__' is not equal to 'head__' desc = list_first_entry_or_null(&intc_parent_list, ^ include/linux/list.h:555:2: note: expanded from macro 'list_first_entry_or_null' pos__ != head__ ? list_entry(pos__, type, member) : NULL; \ ^~~~~ drivers/of/irq.c:608:10: note: '?' condition is true desc = list_first_entry_or_null(&intc_parent_list, ^ include/linux/list.h:555:2: note: expanded from macro 'list_first_entry_or_null' pos__ != head__ ? list_entry(pos__, type, member) : NULL; \ ^ drivers/of/irq.c:610:7: note: Assuming 'desc' is null if (!desc) { ^~~~~ drivers/of/irq.c:610:3: note: Taking true branch if (!desc) { ^ drivers/of/irq.c:611:4: note: Loop condition is false. Exiting loop pr_err("of_irq_init: children remain, but no parents\n"); ^ include/linux/printk.h:489:2: note: expanded from macro 'pr_err' printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) ^ include/linux/printk.h:446:26: note: expanded from macro 'printk' #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__) ^ include/linux/printk.h:417:3: note: expanded from macro 'printk_index_wrap' __printk_index_emit(_fmt, NULL, NULL); \ ^ include/linux/printk.h:392:34: note: expanded from macro '__printk_index_emit' #define __printk_index_emit(...) do {} while (0) ^ drivers/of/irq.c:612:4: note: Execution continues on line 619 break; ^ drivers/of/irq.c:619:27: note: Null pointer value stored to 'desc' list_for_each_entry_safe(desc, temp_desc, &intc_parent_list, list) { ^ include/linux/list.h:725:7: note: expanded from macro 'list_for_each_entry_safe' for (pos = list_first_entry(head, typeof(*pos), member), \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/of/irq.c:619:2: note: Dereference of null pointer list_for_each_entry_safe(desc, temp_desc, &intc_parent_list, list) { ^ include/linux/list.h:726:7: note: expanded from macro 'list_for_each_entry_safe' n = list_next_entry(pos, member); \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/list.h:564:2: note: expanded from macro 'list_next_entry' list_entry((pos)->member.next, typeof(*(pos)), member) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/list.h:520:2: note: expanded from macro 'list_entry' container_of(ptr, type, member) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/container_of.h:18:25: note: expanded from macro 'container_of' void *__mptr = (void *)(ptr); \ ^~~~~ >> drivers/of/irq.c:619:2: warning: Use of memory after it is freed >> [clang-analyzer-unix.Malloc] list_for_each_entry_safe(desc, temp_desc, &intc_parent_list, list) { ^ include/linux/list.h:726:7: note: expanded from macro 'list_for_each_entry_safe' n = list_next_entry(pos, member); \ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/list.h:564:2: note: expanded from macro 'list_next_entry' list_entry((pos)->member.next, typeof(*(pos)), member) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/list.h:520:2: note: expanded from macro 'list_entry' container_of(ptr, type, member) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/container_of.h:18:25: note: expanded from macro 'container_of' void *__mptr = (void *)(ptr); \ ^~~~~ drivers/of/irq.c:532:2: note: Loop condition is true. Entering loop body for_each_matching_node_and_match(np, matches, &match) { ^ include/linux/of.h:1354:2: note: expanded from macro 'for_each_matching_node_and_match' for (dn = of_find_matching_node_and_match(NULL, matches, match); \ ^ drivers/of/irq.c:533:58: note: Left side of '||' is true if (!of_property_read_bool(np, "interrupt-controller") || ^ drivers/of/irq.c:535:4: note: Execution continues on line 532 continue; ^ drivers/of/irq.c:532:2: note: Loop condition is true. Entering loop body for_each_matching_node_and_match(np, matches, &match) { ^ include/linux/of.h:1354:2: note: expanded from macro 'for_each_matching_node_and_match' for (dn = of_find_matching_node_and_match(NULL, matches, match); \ ^ drivers/of/irq.c:533:58: note: Left side of '||' is true if (!of_property_read_bool(np, "interrupt-controller") || ^ drivers/of/irq.c:535:4: note: Execution continues on line 532 continue; ^ drivers/of/irq.c:532:2: note: Loop condition is true. Entering loop body for_each_matching_node_and_match(np, matches, &match) { ^ include/linux/of.h:1354:2: note: expanded from macro 'for_each_matching_node_and_match' for (dn = of_find_matching_node_and_match(NULL, matches, match); \ ^ drivers/of/irq.c:533:7: note: Left side of '||' is false if (!of_property_read_bool(np, "interrupt-controller") || ^ drivers/of/irq.c:534:5: note: Assuming the condition is false !of_device_is_available(np)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/of/irq.c:533:3: note: Taking false branch if (!of_property_read_bool(np, "interrupt-controller") || ^ drivers/of/irq.c:537:12: note: Assuming field 'data' is non-null if (WARN(!match->data, "of_irq_init: no init function for %s\n", ^ include/asm-generic/bug.h:130:25: note: expanded from macro 'WARN' int __ret_warn_on = !!(condition); \ ^~~~~~~~~ drivers/of/irq.c:537:7: note: Taking false branch if (WARN(!match->data, "of_irq_init: no init function for %s\n", ^ include/asm-generic/bug.h:131:2: note: expanded from macro 'WARN' if (unlikely(__ret_warn_on)) \ ^ drivers/of/irq.c:537:3: note: Taking false branch if (WARN(!match->data, "of_irq_init: no init function for %s\n", ^ drivers/of/irq.c:546:7: note: Assuming 'desc' is non-null if (!desc) { ^~~~~ drivers/of/irq.c:546:3: note: Taking false branch if (!desc) { ^ drivers/of/irq.c:559:7: note: Assuming field 'interrupt_parent' is non-null if (!desc->interrupt_parent) ^~~~~~~~~~~~~~~~~~~~~~~ drivers/of/irq.c:559:3: note: Taking false branch if (!desc->interrupt_parent) ^ drivers/of/irq.c:561:7: note: Assuming 'np' is equal to field 'interrupt_parent' if (desc->interrupt_parent == np) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/of/irq.c:561:3: note: Taking true branch if (desc->interrupt_parent == np) { ^ drivers/of/irq.c:532:2: note: Loop condition is false. Execution continues on line 573 for_each_matching_node_and_match(np, matches, &match) { ^ include/linux/of.h:1354:2: note: expanded from macro 'for_each_matching_node_and_match' for (dn = of_find_matching_node_and_match(NULL, matches, match); \ ^ drivers/of/irq.c:573:2: note: Loop condition is true. Entering loop body while (!list_empty(&intc_desc_list)) { ^ drivers/of/irq.c:579:3: note: Loop condition is true. Entering loop body list_for_each_entry_safe(desc, temp_desc, &intc_desc_list, list) { ^ include/linux/list.h:725:2: note: expanded from macro 'list_for_each_entry_safe' for (pos = list_first_entry(head, typeof(*pos), member), \ vim +619 drivers/of/irq.c c71a54b0820179 Rob Herring 2011-09-20 514 c71a54b0820179 Rob Herring 2011-09-20 515 /** c71a54b0820179 Rob Herring 2011-09-20 516 * of_irq_init - Scan and init matching interrupt controllers in DT c71a54b0820179 Rob Herring 2011-09-20 517 * @matches: 0 terminated array of nodes to match and init function to call c71a54b0820179 Rob Herring 2011-09-20 518 * c71a54b0820179 Rob Herring 2011-09-20 519 * This function scans the device tree for matching interrupt controller nodes, c71a54b0820179 Rob Herring 2011-09-20 520 * and calls their initialization functions in order with parents first. c71a54b0820179 Rob Herring 2011-09-20 521 */ c71a54b0820179 Rob Herring 2011-09-20 522 void __init of_irq_init(const struct of_device_id *matches) c71a54b0820179 Rob Herring 2011-09-20 523 { 264041e3796133 Masahiro Yamada 2015-11-24 524 const struct of_device_id *match; c71a54b0820179 Rob Herring 2011-09-20 525 struct device_node *np, *parent = NULL; 48a9b733e644ab Geert Uytterhoeven 2015-06-26 526 struct of_intc_desc *desc, *temp_desc; c71a54b0820179 Rob Herring 2011-09-20 527 struct list_head intc_desc_list, intc_parent_list; c71a54b0820179 Rob Herring 2011-09-20 528 c71a54b0820179 Rob Herring 2011-09-20 529 INIT_LIST_HEAD(&intc_desc_list); c71a54b0820179 Rob Herring 2011-09-20 530 INIT_LIST_HEAD(&intc_parent_list); c71a54b0820179 Rob Herring 2011-09-20 531 264041e3796133 Masahiro Yamada 2015-11-24 532 for_each_matching_node_and_match(np, matches, &match) { 6a245d959c7470 Sergei Shtylyov 2017-07-08 533 if (!of_property_read_bool(np, "interrupt-controller") || bf49be02d6f92b Peter Crosthwaite 2013-11-27 534 !of_device_is_available(np)) c71a54b0820179 Rob Herring 2011-09-20 535 continue; 264041e3796133 Masahiro Yamada 2015-11-24 536 264041e3796133 Masahiro Yamada 2015-11-24 537 if (WARN(!match->data, "of_irq_init: no init function for %s\n", 264041e3796133 Masahiro Yamada 2015-11-24 538 match->compatible)) 264041e3796133 Masahiro Yamada 2015-11-24 539 continue; 264041e3796133 Masahiro Yamada 2015-11-24 540 c71a54b0820179 Rob Herring 2011-09-20 541 /* 48a9b733e644ab Geert Uytterhoeven 2015-06-26 542 * Here, we allocate and populate an of_intc_desc with the node c71a54b0820179 Rob Herring 2011-09-20 543 * pointer, interrupt-parent device_node etc. c71a54b0820179 Rob Herring 2011-09-20 544 */ c71a54b0820179 Rob Herring 2011-09-20 545 desc = kzalloc(sizeof(*desc), GFP_KERNEL); 6f7dc9a37f2b32 Geert Uytterhoeven 2019-05-02 546 if (!desc) { 8363ccb917c6bd Julia Lawall 2015-10-22 547 of_node_put(np); c71a54b0820179 Rob Herring 2011-09-20 548 goto err; 8363ccb917c6bd Julia Lawall 2015-10-22 549 } c71a54b0820179 Rob Herring 2011-09-20 550 264041e3796133 Masahiro Yamada 2015-11-24 551 desc->irq_init_cb = match->data; 8363ccb917c6bd Julia Lawall 2015-10-22 552 desc->dev = of_node_get(np); e91033621d56e0 Samuel Holland 2022-04-12 553 /* e91033621d56e0 Samuel Holland 2022-04-12 554 * interrupts-extended can reference multiple parent domains. e91033621d56e0 Samuel Holland 2022-04-12 555 * Arbitrarily pick the first one; assume any other parents e91033621d56e0 Samuel Holland 2022-04-12 556 * are the same distance away from the root irq controller. e91033621d56e0 Samuel Holland 2022-04-12 557 */ e91033621d56e0 Samuel Holland 2022-04-12 558 desc->interrupt_parent = of_parse_phandle(np, "interrupts-extended", 0); e91033621d56e0 Samuel Holland 2022-04-12 559 if (!desc->interrupt_parent) c71a54b0820179 Rob Herring 2011-09-20 560 desc->interrupt_parent = of_irq_find_parent(np); e91033621d56e0 Samuel Holland 2022-04-12 561 if (desc->interrupt_parent == np) { e91033621d56e0 Samuel Holland 2022-04-12 562 of_node_put(desc->interrupt_parent); d7fb6d0adb86ed Rob Herring 2011-11-27 563 desc->interrupt_parent = NULL; e91033621d56e0 Samuel Holland 2022-04-12 564 } c71a54b0820179 Rob Herring 2011-09-20 565 list_add_tail(&desc->list, &intc_desc_list); c71a54b0820179 Rob Herring 2011-09-20 566 } c71a54b0820179 Rob Herring 2011-09-20 567 c71a54b0820179 Rob Herring 2011-09-20 568 /* c71a54b0820179 Rob Herring 2011-09-20 569 * The root irq controller is the one without an interrupt-parent. c71a54b0820179 Rob Herring 2011-09-20 570 * That one goes first, followed by the controllers that reference it, c71a54b0820179 Rob Herring 2011-09-20 571 * followed by the ones that reference the 2nd level controllers, etc. c71a54b0820179 Rob Herring 2011-09-20 572 */ c71a54b0820179 Rob Herring 2011-09-20 573 while (!list_empty(&intc_desc_list)) { c71a54b0820179 Rob Herring 2011-09-20 574 /* c71a54b0820179 Rob Herring 2011-09-20 575 * Process all controllers with the current 'parent'. c71a54b0820179 Rob Herring 2011-09-20 576 * First pass will be looking for NULL as the parent. c71a54b0820179 Rob Herring 2011-09-20 577 * The assumption is that NULL parent means a root controller. c71a54b0820179 Rob Herring 2011-09-20 578 */ c71a54b0820179 Rob Herring 2011-09-20 579 list_for_each_entry_safe(desc, temp_desc, &intc_desc_list, list) { c71a54b0820179 Rob Herring 2011-09-20 580 int ret; c71a54b0820179 Rob Herring 2011-09-20 581 c71a54b0820179 Rob Herring 2011-09-20 582 if (desc->interrupt_parent != parent) c71a54b0820179 Rob Herring 2011-09-20 583 continue; c71a54b0820179 Rob Herring 2011-09-20 584 c71a54b0820179 Rob Herring 2011-09-20 585 list_del(&desc->list); c71a54b0820179 Rob Herring 2011-09-20 586 e55aeb6ba4e8cc Philipp Zabel 2016-08-09 587 of_node_set_flag(desc->dev, OF_POPULATED); e55aeb6ba4e8cc Philipp Zabel 2016-08-09 588 0d638a07d3a1e9 Rob Herring 2017-06-01 589 pr_debug("of_irq_init: init %pOF (%p), parent %p\n", 0d638a07d3a1e9 Rob Herring 2017-06-01 590 desc->dev, c71a54b0820179 Rob Herring 2011-09-20 591 desc->dev, desc->interrupt_parent); 264041e3796133 Masahiro Yamada 2015-11-24 592 ret = desc->irq_init_cb(desc->dev, 264041e3796133 Masahiro Yamada 2015-11-24 593 desc->interrupt_parent); c71a54b0820179 Rob Herring 2011-09-20 594 if (ret) { e55aeb6ba4e8cc Philipp Zabel 2016-08-09 595 of_node_clear_flag(desc->dev, OF_POPULATED); c71a54b0820179 Rob Herring 2011-09-20 596 kfree(desc); c71a54b0820179 Rob Herring 2011-09-20 597 continue; c71a54b0820179 Rob Herring 2011-09-20 598 } c71a54b0820179 Rob Herring 2011-09-20 599 c71a54b0820179 Rob Herring 2011-09-20 600 /* c71a54b0820179 Rob Herring 2011-09-20 601 * This one is now set up; add it to the parent list so c71a54b0820179 Rob Herring 2011-09-20 602 * its children can get processed in a subsequent pass. c71a54b0820179 Rob Herring 2011-09-20 603 */ c71a54b0820179 Rob Herring 2011-09-20 604 list_add_tail(&desc->list, &intc_parent_list); c71a54b0820179 Rob Herring 2011-09-20 605 } c71a54b0820179 Rob Herring 2011-09-20 606 c71a54b0820179 Rob Herring 2011-09-20 607 /* Get the next pending parent that might have children */ c0cdfaa0a5e7a3 Axel Lin 2013-06-23 608 desc = list_first_entry_or_null(&intc_parent_list, c0cdfaa0a5e7a3 Axel Lin 2013-06-23 609 typeof(*desc), list); c0cdfaa0a5e7a3 Axel Lin 2013-06-23 610 if (!desc) { c71a54b0820179 Rob Herring 2011-09-20 611 pr_err("of_irq_init: children remain, but no parents\n"); c71a54b0820179 Rob Herring 2011-09-20 612 break; c71a54b0820179 Rob Herring 2011-09-20 613 } c71a54b0820179 Rob Herring 2011-09-20 614 list_del(&desc->list); c71a54b0820179 Rob Herring 2011-09-20 615 parent = desc->dev; c71a54b0820179 Rob Herring 2011-09-20 616 kfree(desc); c71a54b0820179 Rob Herring 2011-09-20 617 } c71a54b0820179 Rob Herring 2011-09-20 618 c71a54b0820179 Rob Herring 2011-09-20 @619 list_for_each_entry_safe(desc, temp_desc, &intc_parent_list, list) { c71a54b0820179 Rob Herring 2011-09-20 620 list_del(&desc->list); c71a54b0820179 Rob Herring 2011-09-20 621 kfree(desc); c71a54b0820179 Rob Herring 2011-09-20 622 } c71a54b0820179 Rob Herring 2011-09-20 623 err: c71a54b0820179 Rob Herring 2011-09-20 624 list_for_each_entry_safe(desc, temp_desc, &intc_desc_list, list) { c71a54b0820179 Rob Herring 2011-09-20 625 list_del(&desc->list); 8363ccb917c6bd Julia Lawall 2015-10-22 626 of_node_put(desc->dev); c71a54b0820179 Rob Herring 2011-09-20 627 kfree(desc); c71a54b0820179 Rob Herring 2011-09-20 628 } c71a54b0820179 Rob Herring 2011-09-20 629 } c706c239af5bc2 Marc Zyngier 2015-07-28 630 :::::: The code at line 619 was first introduced by commit :::::: c71a54b0820179e53483d5220cdef1a0df8d5bd1 of/irq: introduce of_irq_init :::::: TO: Rob Herring <[email protected]> :::::: CC: Arnd Bergmann <[email protected]> -- 0-DAY CI Kernel Test Service https://01.org/lkp _______________________________________________ kbuild mailing list -- [email protected] To unsubscribe send an email to [email protected]
