From: kernel test robot <lkp@intel.com>
To: kbuild@lists.01.org
Subject: net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:117:2: warning: Use of memory after it is freed [clang-analyzer-unix.Malloc]
Date: Tue, 30 Nov 2021 00:08:21 +0800 [thread overview]
Message-ID: <202111300014.aRxYVvja-lkp@intel.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 14059 bytes --]
CC: llvm(a)lists.linux.dev
CC: kbuild-all(a)lists.01.org
CC: linux-kernel(a)vger.kernel.org
TO: Chuck Lever <chuck.lever@oracle.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: d58071a8a76d779eedab38033ae4c821c30295a5
commit: 7954c8503b8709660d93505a40f1847634d9c3ba svcrdma: Remove chunk list pointers
date: 12 months ago
:::::: branch date: 18 hours ago
:::::: commit date: 12 months ago
config: x86_64-randconfig-c007-20211124 (https://download.01.org/0day-ci/archive/20211130/202111300014.aRxYVvja-lkp(a)intel.com/config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 67a1c45def8a75061203461ab0060c75c864df1c)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7954c8503b8709660d93505a40f1847634d9c3ba
git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
git fetch --no-tags linus master
git checkout 7954c8503b8709660d93505a40f1847634d9c3ba
# save the config file to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=x86_64 clang-analyzer
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
clang-analyzer warnings: (new ones prefixed by >>)
^
fs/cifs/cifsproto.h:51:2: note: expanded from macro 'get_xid'
cifs_dbg(FYI, "VFS: in %s as Xid: %u with uid: %d\n", \
^
fs/cifs/cifs_debug.h:137:38: note: expanded from macro 'cifs_dbg'
#define cifs_dbg(type, fmt, ...) \
^
fs/cifs/inode.c:1876:6: note: Assuming 'full_path' is not equal to NULL
if (full_path == NULL) {
^~~~~~~~~~~~~~~~~
fs/cifs/inode.c:1876:2: note: Taking false branch
if (full_path == NULL) {
^
fs/cifs/inode.c:1883:6: note: Assuming field 'posix_mkdir' is null
if ((server->ops->posix_mkdir) && (tcon->posix_extensions)) {
^~~~~~~~~~~~~~~~~~~~~~~~~~
fs/cifs/inode.c:1883:33: note: Left side of '&&' is false
if ((server->ops->posix_mkdir) && (tcon->posix_extensions)) {
^
fs/cifs/inode.c:1890:6: note: Assuming the condition is false
if (cap_unix(tcon->ses) && (CIFS_UNIX_POSIX_PATH_OPS_CAP &
^~~~~~~~~~~~~~~~~~~
fs/cifs/inode.c:1890:26: note: Left side of '&&' is false
if (cap_unix(tcon->ses) && (CIFS_UNIX_POSIX_PATH_OPS_CAP &
^
fs/cifs/inode.c:1898:6: note: Assuming field 'mkdir' is non-null
if (!server->ops->mkdir) {
^~~~~~~~~~~~~~~~~~~
fs/cifs/inode.c:1898:2: note: Taking false branch
if (!server->ops->mkdir) {
^
fs/cifs/inode.c:1905:6: note: Assuming 'rc' is 0
if (rc) {
^~
fs/cifs/inode.c:1905:2: note: Taking false branch
if (rc) {
^
fs/cifs/inode.c:1912:7: note: Calling 'cifs_mkdir_qinfo'
rc = cifs_mkdir_qinfo(inode, direntry, mode, full_path, cifs_sb, tcon,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/cifs/inode.c:1723:2: note: 'inode' initialized to a null pointer value
struct inode *inode = NULL;
^~~~~~~~~~~~~~~~~~~
fs/cifs/inode.c:1725:6: note: Assuming field 'posix_extensions' is true
if (tcon->posix_extensions)
^~~~~~~~~~~~~~~~~~~~~~
fs/cifs/inode.c:1725:2: note: Taking true branch
if (tcon->posix_extensions)
^
fs/cifs/inode.c:1726:8: note: Calling 'smb311_posix_get_inode_info'
rc = smb311_posix_get_inode_info(&inode, full_path, parent->i_sb, xid);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/cifs/inode.c:1131:6: note: Calling 'IS_ERR'
if (IS_ERR(tlink))
^~~~~~~~~~~~~
include/linux/err.h:36:9: note: Assuming the condition is true
return IS_ERR_VALUE((unsigned long)ptr);
^
include/linux/err.h:22:34: note: expanded from macro 'IS_ERR_VALUE'
#define IS_ERR_VALUE(x) unlikely((unsigned long)(void *)(x) >= (unsigned long)-MAX_ERRNO)
~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/compiler.h:78:42: note: expanded from macro 'unlikely'
# define unlikely(x) __builtin_expect(!!(x), 0)
^
include/linux/err.h:36:2: note: Returning the value 1, which participates in a condition later
return IS_ERR_VALUE((unsigned long)ptr);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/cifs/inode.c:1131:6: note: Returning from 'IS_ERR'
if (IS_ERR(tlink))
^~~~~~~~~~~~~
fs/cifs/inode.c:1131:2: note: Taking true branch
if (IS_ERR(tlink))
^
fs/cifs/inode.c:1132:3: note: Returning without writing to '*inode'
return PTR_ERR(tlink);
^
fs/cifs/inode.c:1132:3: note: Returning value, which participates in a condition later
return PTR_ERR(tlink);
^~~~~~~~~~~~~~~~~~~~~
fs/cifs/inode.c:1726:8: note: Returning from 'smb311_posix_get_inode_info'
rc = smb311_posix_get_inode_info(&inode, full_path, parent->i_sb, xid);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/cifs/inode.c:1734:6: note: Assuming 'rc' is 0
if (rc)
^~
fs/cifs/inode.c:1734:2: note: Taking false branch
if (rc)
^
fs/cifs/inode.c:1742:6: note: Dereference of null pointer
if (inode->i_nlink < 2)
^~~~~~~~~~~~~~
fs/cifs/inode.c:2633:2: warning: Value stored to 'rc' is never read [clang-analyzer-deadcode.DeadStores]
rc = 0;
^ ~
fs/cifs/inode.c:2633:2: note: Value stored to 'rc' is never read
rc = 0;
^ ~
Suppressed 4 warnings (4 in non-user code).
Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
5 warnings generated.
>> net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:117:2: warning: Use of memory after it is freed [clang-analyzer-unix.Malloc]
return list_first_entry_or_null(list, struct svc_rdma_recv_ctxt,
^
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:377:17: note: Calling 'svc_rdma_next_recv_ctxt'
while ((ctxt = svc_rdma_next_recv_ctxt(&rdma->sc_read_complete_q))) {
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:117:9: note: Left side of '||' is false
return list_first_entry_or_null(list, struct svc_rdma_recv_ctxt,
^
include/linux/list.h:545:28: note: expanded from macro 'list_first_entry_or_null'
struct list_head *pos__ = READ_ONCE(head__->next); \
^
include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE'
compiletime_assert_rwonce_type(x); \
^
include/asm-generic/rwonce.h:36:21: note: expanded from macro 'compiletime_assert_rwonce_type'
compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
^
include/linux/compiler_types.h:277:3: note: expanded from macro '__native_word'
(sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || \
^
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:117:9: note: Left side of '||' is false
return list_first_entry_or_null(list, struct svc_rdma_recv_ctxt,
^
include/linux/list.h:545:28: note: expanded from macro 'list_first_entry_or_null'
struct list_head *pos__ = READ_ONCE(head__->next); \
^
include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE'
compiletime_assert_rwonce_type(x); \
^
include/asm-generic/rwonce.h:36:21: note: expanded from macro 'compiletime_assert_rwonce_type'
compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
^
include/linux/compiler_types.h:277:3: note: expanded from macro '__native_word'
(sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || \
^
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:117:9: note: Left side of '||' is false
return list_first_entry_or_null(list, struct svc_rdma_recv_ctxt,
^
include/linux/list.h:545:28: note: expanded from macro 'list_first_entry_or_null'
struct list_head *pos__ = READ_ONCE(head__->next); \
^
include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE'
compiletime_assert_rwonce_type(x); \
^
include/asm-generic/rwonce.h:36:21: note: expanded from macro 'compiletime_assert_rwonce_type'
compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
^
include/linux/compiler_types.h:277:3: note: expanded from macro '__native_word'
(sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || \
^
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:117:9: note: Left side of '||' is true
return list_first_entry_or_null(list, struct svc_rdma_recv_ctxt,
^
include/linux/list.h:545:28: note: expanded from macro 'list_first_entry_or_null'
struct list_head *pos__ = READ_ONCE(head__->next); \
^
include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE'
compiletime_assert_rwonce_type(x); \
^
include/asm-generic/rwonce.h:36:38: note: expanded from macro 'compiletime_assert_rwonce_type'
compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
^
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:117:9: note: Taking false branch
return list_first_entry_or_null(list, struct svc_rdma_recv_ctxt,
^
include/linux/list.h:545:28: note: expanded from macro 'list_first_entry_or_null'
struct list_head *pos__ = READ_ONCE(head__->next); \
^
include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE'
compiletime_assert_rwonce_type(x); \
^
include/asm-generic/rwonce.h:36:2: note: expanded from macro 'compiletime_assert_rwonce_type'
compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
^
include/linux/compiler_types.h:315:2: note: expanded from macro 'compiletime_assert'
_compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
^
include/linux/compiler_types.h:303:2: note: expanded from macro '_compiletime_assert'
__compiletime_assert(condition, msg, prefix, suffix)
^
include/linux/compiler_types.h:295:3: note: expanded from macro '__compiletime_assert'
if (!(condition)) \
^
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:117:9: note: Loop condition is false. Exiting loop
return list_first_entry_or_null(list, struct svc_rdma_recv_ctxt,
^
include/linux/list.h:545:28: note: expanded from macro 'list_first_entry_or_null'
struct list_head *pos__ = READ_ONCE(head__->next); \
^
include/asm-generic/rwonce.h:49:2: note: expanded from macro 'READ_ONCE'
compiletime_assert_rwonce_type(x); \
^
include/asm-generic/rwonce.h:36:2: note: expanded from macro 'compiletime_assert_rwonce_type'
compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
^
include/linux/compiler_types.h:315:2: note: expanded from macro 'compiletime_assert'
_compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
^
include/linux/compiler_types.h:303:2: note: expanded from macro '_compiletime_assert'
__compiletime_assert(condition, msg, prefix, suffix)
vim +117 net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
ecf85b2384ea5f Chuck Lever 2018-05-07 113
ecf85b2384ea5f Chuck Lever 2018-05-07 114 static inline struct svc_rdma_recv_ctxt *
ecf85b2384ea5f Chuck Lever 2018-05-07 115 svc_rdma_next_recv_ctxt(struct list_head *list)
ecf85b2384ea5f Chuck Lever 2018-05-07 116 {
ecf85b2384ea5f Chuck Lever 2018-05-07 @117 return list_first_entry_or_null(list, struct svc_rdma_recv_ctxt,
ecf85b2384ea5f Chuck Lever 2018-05-07 118 rc_list);
ecf85b2384ea5f Chuck Lever 2018-05-07 119 }
ecf85b2384ea5f Chuck Lever 2018-05-07 120
:::::: The code at line 117 was first introduced by commit
:::::: ecf85b2384ea5f7cb0577bf6143bc46d9ecfe4d3 svcrdma: Introduce svc_rdma_recv_ctxt
:::::: TO: Chuck Lever <chuck.lever@oracle.com>
:::::: CC: J. Bruce Fields <bfields@redhat.com>
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
next reply other threads:[~2021-11-29 16:08 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-29 16:08 kernel test robot [this message]
-- strict thread matches above, loose matches on Subject: below --
2021-11-28 9:45 net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:117:2: warning: Use of memory after it is freed [clang-analyzer-unix.Malloc] kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202111300014.aRxYVvja-lkp@intel.com \
--to=lkp@intel.com \
--cc=kbuild@lists.01.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.