From: kernel test robot <lkp@intel.com>
To: kbuild@lists.01.org
Subject: [linux-next:master 10407/12552] drivers/usb/gadget/udc/renesas_usb3.c:1063:14: warning: use of uninitialized value '((unsigned char*)&*(struct usb_request *)usb3_req)[26]' [CWE-457]
Date: Mon, 25 Jul 2022 21:42:30 +0800 [thread overview]
Message-ID: <202207252132.CqsKFXCg-lkp@intel.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 17559 bytes --]
::::::
:::::: Manual check reason: "low confidence bisect report"
:::::: Manual check reason: "low confidence static check first_new_problem: drivers/usb/gadget/udc/renesas_usb3.c:1063:14: warning: use of uninitialized value '((unsigned char*)&*(struct usb_request *)usb3_req)[26]' [CWE-457] [-Wanalyzer-use-of-uninitialized-value]"
::::::
CC: kbuild-all(a)lists.01.org
BCC: lkp(a)intel.com
CC: Linux Memory Management List <linux-mm@kvack.org>
TO: Uros Bizjak <ubizjak@gmail.com>
CC: Andrew Morton <akpm@linux-foundation.org>
CC: Linux Memory Management List <linux-mm@kvack.org>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head: 18c107a1f120d095404d141dfad8f594bdc44020
commit: 43c249ea0b1e10baac4a1264a25d69723ce5d2c2 [10407/12552] compiler-gcc.h: remove ancient workaround for gcc PR 58670
:::::: branch date: 3 days ago
:::::: commit date: 8 days ago
config: arm-randconfig-c002-20220724 (https://download.01.org/0day-ci/archive/20220725/202207252132.CqsKFXCg-lkp(a)intel.com/config)
compiler: arm-linux-gnueabi-gcc (GCC) 12.1.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=43c249ea0b1e10baac4a1264a25d69723ce5d2c2
git remote add linux-next https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
git fetch --no-tags linux-next master
git checkout 43c249ea0b1e10baac4a1264a25d69723ce5d2c2
# save the config file
ARCH=arm KBUILD_USERCFLAGS='-fanalyzer -Wno-error'
If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@intel.com>
gcc-analyzer warnings: (new ones prefixed by >>)
| | |
| | (18) following 'true' branch...
| 1898 | usb3_irq_epc_pipe0_setup(usb3);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (19) ...to here
| | (20) calling 'usb3_irq_epc_pipe0_setup' from 'usb3_irq_epc_pipe0'
|
+--> 'usb3_irq_epc_pipe0_setup': events 21-24
|
| 1861 | static void usb3_irq_epc_pipe0_setup(struct renesas_usb3 *usb3)
| | ^~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (21) entry to 'usb3_irq_epc_pipe0_setup'
|......
| 1867 | if (usb3_ep->started)
| | ~
| | |
| | (22) following 'true' branch...
| 1868 | usb3_request_done(usb3_ep, usb3_get_request(usb3_ep),
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (23) ...to here
| | (24) calling 'usb3_get_request' from 'usb3_irq_epc_pipe0_setup'
| 1869 | -ECONNRESET);
| | ~~~~~~~~~~~~
|
+--> 'usb3_get_request': event 25
|
| 892 | static struct renesas_usb3_request *usb3_get_request(struct renesas_usb3_ep
| | ^~~~~~~~~~~~~~~~
| | |
| | (25) entry to 'usb3_get_request'
|
'usb3_get_request': event 26
|
|include/linux/list.h:555:59:
| 555 | pos__ != head__ ? list_entry(pos__, type, member) : NULL; \
drivers/usb/gadget/udc/renesas_usb3.c:888:16: note: in expansion of macro 'list_first_entry_or_null'
| 888 | return list_first_entry_or_null(&usb3_ep->queue,
| | ^~~~~~~~~~~~~~~~~~~~~~~~
|
'usb3_get_request': event 27
|
|include/linux/spinlock.h:280:17:
| 280 | _raw_spin_unlock_irqrestore(lock, flags); \
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (27) ...to here
include/linux/spinlock.h:404:9: note: in expansion of macro 'raw_spin_unlock_irqrestore'
| 404 | raw_spin_unlock_irqrestore(&lock->rlock, flags);
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~
|
<------+
|
'usb3_irq_epc_pipe0_setup': events 28-29
|
|drivers/usb/gadget/udc/renesas_usb3.c:1868:17:
| 1868 | usb3_request_done(usb3_ep, usb3_get_request(usb3_ep),
| | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (28) returning to 'usb3_irq_epc_pipe0_setup' from 'usb3_get_request'
| | (29) calling 'usb3_request_done' from 'usb3_irq_epc_pipe0_setup'
| 1869 | -ECONNRESET);
| | ~~~~~~~~~~~~
|
+--> 'usb3_request_done': events 30-31
|
| 923 | static void usb3_request_done(struct renesas_usb3_ep *usb3_ep,
| | ^~~~~~~~~~~~~~~~~
| | |
| | (30) entry to 'usb3_request_done'
|......
| 930 | __usb3_request_done(usb3_ep, usb3_req, status);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (31) calling '__usb3_request_done' from 'usb3_request_done'
|
+--> '__usb3_request_done': event 32
|
| 906 | static void __usb3_request_done(struct renesas_usb3_ep *usb3_ep,
| | ^~~~~~~~~~~~~~~~~~~
| | |
| | (32) entry to '__usb3_request_done'
|
'__usb3_request_done': event 33
|
|include/asm-generic/rwonce.h:55:37:
| 55 | *(volatile typeof(x) *)&(x) = (val); \
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~
| | |
| | (33) dereference of NULL 'usb3_req'
include/asm-generic/rwonce.h:61:9: note: in expansion of macro '__WRITE_ONCE'
| 61 | __WRITE_ONCE(x, val); \
| | ^~~~~~~~~~~~
include/linux/list.h:37:9: note: in expansion of macro 'WRITE_ONCE'
| 37 | WRITE_ONCE(list->next, list);
| | ^~~~~~~~~~
|
drivers/usb/gadget/udc/renesas_usb3.c: In function 'usb3_is_transfer_complete':
>> drivers/usb/gadget/udc/renesas_usb3.c:1063:14: warning: use of uninitialized value '((unsigned char*)&*(struct usb_request *)usb3_req)[26]' [CWE-457] [-Wanalyzer-use-of-uninitialized-value]
1063 | if ((!req->zero && req->actual == req->length) ||
| ^~~~~~~~~~
'renesas_usb3_ep_dequeue': events 1-2
|
| 2227 | static int renesas_usb3_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
| | ^~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (1) entry to 'renesas_usb3_ep_dequeue'
|......
| 2237 | usb3_request_done_pipen(usb3, usb3_ep, usb3_req, -ECONNRESET);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (2) calling 'usb3_request_done_pipen' from 'renesas_usb3_ep_dequeue'
|
+--> 'usb3_request_done_pipen': events 3-4
|
| 1903 | static void usb3_request_done_pipen(struct renesas_usb3 *usb3,
| | ^~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (3) entry to 'usb3_request_done_pipen'
|......
| 1919 | usb3_req = usb3_get_request(usb3_ep);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (4) calling 'usb3_get_request' from 'usb3_request_done_pipen'
|
+--> 'usb3_get_request': event 5
|
| 892 | static struct renesas_usb3_request *usb3_get_request(struct renesas_usb3_ep
| | ^~~~~~~~~~~~~~~~
| | |
| | (5) entry to 'usb3_get_request'
|
'usb3_get_request': event 6
|
|include/linux/list.h:555:59:
| 555 | pos__ != head__ ? list_entry(pos__, type, member) : NULL; \
drivers/usb/gadget/udc/renesas_usb3.c:888:16: note: in expansion of macro 'list_first_entry_or_null'
| 888 | return list_first_entry_or_null(&usb3_ep->queue,
| | ^~~~~~~~~~~~~~~~~~~~~~~~
|
'usb3_get_request': event 7
|
|include/linux/container_of.h:22:10:
| 22 | ((type *)(__mptr - offsetof(type, member))); })
| | ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (7) ...to here
include/linux/list.h:520:9: note: in expansion of macro 'container_of'
| 520 | container_of(ptr, type, member)
| | ^~~~~~~~~~~~
include/linux/list.h:555:27: note: in expansion of macro 'list_entry'
| 555 | pos__ != head__ ? list_entry(pos__, type, member) : NULL; \
| | ^~~~~~~~~~
drivers/usb/gadget/udc/renesas_usb3.c:888:16: note: in expansion of macro 'list_first_entry_or_null'
| 888 | return list_first_entry_or_null(&usb3_ep->queue,
| | ^~~~~~~~~~~~~~~~~~~~~~~~
|
<------+
|
'usb3_request_done_pipen': events 8-11
|
| 1919 | usb3_req = usb3_get_request(usb3_ep);
| | ^~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (8) returning to 'usb3_request_done_pipen' from 'usb3_get_request'
| 1920 | if (usb3_req)
| | ~
| | |
| | (9) following 'true' branch (when 'usb3_req' is non-NULL)...
| 1921 | usb3_start_pipen(usb3_ep, usb3_req);
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (10) ...to here
| | (11) calling 'usb3_start_pipen' from 'usb3_request_done_pipen'
|
+--> 'usb3_start_pipen': events 12-13
|
| 1487 | static void usb3_start_pipen(struct renesas_usb3_ep *usb3_ep,
| | ^~~~~~~~~~~~~~~~
| | |
| | (12) entry to 'usb3_start_pipen'
|......
| 1497 | if (usb3_ep->halt || usb3_ep->started)
| | ~
| | |
| | (13) following 'false' branch...
|
'usb3_start_pipen': event 14
|
|include/linux/list.h:553:27:
| 553 | struct list_head *head__ = (ptr); \
| | ^~~~~~
| | |
| | (14) ...to here
drivers/usb/gadget/udc/renesas_usb3.c:888:16: note: in expansion of macro 'list_first_entry_or_null'
| 888 | return list_first_entry_or_null(&usb3_ep->queue,
| | ^~~~~~~~~~~~~~~~~~~~~~~~
|
'usb3_start_pipen': events 15-19
vim +1063 drivers/usb/gadget/udc/renesas_usb3.c
746bfe63bba37a Yoshihiro Shimoda 2015-12-21 1057
746bfe63bba37a Yoshihiro Shimoda 2015-12-21 1058 static bool usb3_is_transfer_complete(struct renesas_usb3_ep *usb3_ep,
746bfe63bba37a Yoshihiro Shimoda 2015-12-21 1059 struct renesas_usb3_request *usb3_req)
746bfe63bba37a Yoshihiro Shimoda 2015-12-21 1060 {
746bfe63bba37a Yoshihiro Shimoda 2015-12-21 1061 struct usb_request *req = &usb3_req->req;
746bfe63bba37a Yoshihiro Shimoda 2015-12-21 1062
746bfe63bba37a Yoshihiro Shimoda 2015-12-21 @1063 if ((!req->zero && req->actual == req->length) ||
746bfe63bba37a Yoshihiro Shimoda 2015-12-21 1064 (req->actual % usb3_ep->ep.maxpacket) || (req->length == 0))
746bfe63bba37a Yoshihiro Shimoda 2015-12-21 1065 return true;
746bfe63bba37a Yoshihiro Shimoda 2015-12-21 1066 else
746bfe63bba37a Yoshihiro Shimoda 2015-12-21 1067 return false;
746bfe63bba37a Yoshihiro Shimoda 2015-12-21 1068 }
746bfe63bba37a Yoshihiro Shimoda 2015-12-21 1069
:::::: The code at line 1063 was first introduced by commit
:::::: 746bfe63bba37ad55956b7377c9af494e7e28929 usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller
:::::: TO: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
:::::: CC: Felipe Balbi <balbi@ti.com>
--
0-DAY CI Kernel Test Service
https://01.org/lkp
reply other threads:[~2022-07-25 13:42 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202207252132.CqsKFXCg-lkp@intel.com \
--to=lkp@intel.com \
--cc=kbuild@lists.01.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.