False Positive return_cast check

False Positive return_cast check

[Benjamin Block]

Hello,

I hope this is the right avenue to report this.

I noticed yesterday that we get a false positive report from smatch for
`pathmask_to_pos()` in `arch/s390/include/asm/cio.h`. When reviewing
some code I got this error while using smatch:

    CHECK   /home/bblock/src/linux/drivers/s390/cio/device_pgid.c
  /home/bblock/src/linux/arch/s390/include/asm/cio.h:356 pathmask_to_pos() warn: signedness bug returning '(-119)'

Which corresponds to this helper:

  static inline u8 pathmask_to_pos(u8 mask)
  {
  	return 8 - ffs(mask);
  }

First I assumed this corresponds to some corner case where `ffs()` might
return a negative number, or something bigger than 8 (both are not
supposed to be possible); but I couldn't wrap my head around what
exactly the error message is supposed to tell me with `(-119)`. 

After some exhaustive head scratching I took a look at smatch itself and
found this message is emitted by `check_return_cast.c`, and according to
commit `f65a092d16cf` is supposed to warn me that we return a negative
error code via an unsigned return value type.
    That seems to be a false positive here.

Its not really something terrible important, but after I took so long to
understand what this is telling me, I thought I might as well report it.

-- 
Best Regards, Benjamin Block  / Linux on IBM Z Kernel Development / IBM Systems
IBM Deutschland Research & Development GmbH    /    https://www.ibm.com/privacy
Vorsitz. AufsR.: Gregor Pillen         /        Geschäftsführung: Dirk Wittkopp
Sitz der Gesellschaft: Böblingen / Registergericht: AmtsG Stuttgart, HRB 243294

Re: False Positive return_cast check

[Dan Carpenter]

On Fri, Feb 12, 2021 at 01:42:54PM +0100, Benjamin Block wrote:
> Hello,
> 
> I hope this is the right avenue to report this.
> 
> I noticed yesterday that we get a false positive report from smatch for
> `pathmask_to_pos()` in `arch/s390/include/asm/cio.h`. When reviewing
> some code I got this error while using smatch:
> 
>     CHECK   /home/bblock/src/linux/drivers/s390/cio/device_pgid.c
>   /home/bblock/src/linux/arch/s390/include/asm/cio.h:356 pathmask_to_pos() warn: signedness bug returning '(-119)'
> 
> Which corresponds to this helper:
> 
>   static inline u8 pathmask_to_pos(u8 mask)
>   {
>   	return 8 - ffs(mask);
>   }
> 

Could you add some debug code, like this:


#include "/path/to/smatch/check_debug.h"
static inline u8 pathmask_to_pos(u8 mask)
{
	__smatch_bits(mask);
	__smatch_implied(mask);
	__smatch_implied(ffs(mask));
	return 8 - ffs(mask);
}

Then run:
/path/to/smatch/smatch_scripts/kchecker /home/bblock/src/linux/drivers/s390/cio/device_pgid.c

regards,
dan carpenter

Re: False Positive return_cast check

[Benjamin Block]

On Mon, Feb 15, 2021 at 03:36:25PM +0300, Dan Carpenter wrote:
> On Fri, Feb 12, 2021 at 01:42:54PM +0100, Benjamin Block wrote:
> > Hello,
> > 
> > I hope this is the right avenue to report this.
> > 
> > I noticed yesterday that we get a false positive report from smatch for
> > `pathmask_to_pos()` in `arch/s390/include/asm/cio.h`. When reviewing
> > some code I got this error while using smatch:

Forgot to mention that I am using smatch at commit 1490b5d272bc
(heads/smatch-1.71).

> > 
> >     CHECK   /home/bblock/src/linux/drivers/s390/cio/device_pgid.c
> >   /home/bblock/src/linux/arch/s390/include/asm/cio.h:356 pathmask_to_pos() warn: signedness bug returning '(-119)'
> > 
> > Which corresponds to this helper:
> > 
> >   static inline u8 pathmask_to_pos(u8 mask)
> >   {
> >   	return 8 - ffs(mask);
> >   }
> > 
> 
> Could you add some debug code, like this:
> 
> 
> #include "/path/to/smatch/check_debug.h"
> static inline u8 pathmask_to_pos(u8 mask)
> {
> 	__smatch_bits(mask);
> 	__smatch_implied(mask);
> 	__smatch_implied(ffs(mask));
> 	return 8 - ffs(mask);
> }
> 
> Then run:
> /path/to/smatch/smatch_scripts/kchecker /home/bblock/src/linux/drivers/s390/cio/device_pgid.c
> 

Sure,

I got this:
  make[3]: Nothing to be done for 'drivers/s390/cio/device_pgid.o'.
    CHECK   /home/bblock/src/linux/drivers/s390/cio/device_pgid.c
  /home/bblock/src/linux/arch/s390/include/asm/cio.h:358 pathmask_to_pos() bit info 'mask': definitely set 0x0.  possibly set 0xff.
  /home/bblock/src/linux/arch/s390/include/asm/cio.h:359 pathmask_to_pos() implied: mask = ''
  /home/bblock/src/linux/arch/s390/include/asm/cio.h:360 pathmask_to_pos() implied: ffs(mask) = '0-127'
  /home/bblock/src/linux/arch/s390/include/asm/cio.h:361 pathmask_to_pos() warn: signedness bug returning '(-119)'



(The long paths happen because I use out-of-tree builds with `O=/..`)

-- 
Best Regards, Benjamin Block  / Linux on IBM Z Kernel Development / IBM Systems
IBM Deutschland Research & Development GmbH    /    https://www.ibm.com/privacy
Vorsitz. AufsR.: Gregor Pillen         /        Geschäftsführung: Dirk Wittkopp
Sitz der Gesellschaft: Böblingen / Registergericht: AmtsG Stuttgart, HRB 243294