All of lore.kernel.org
 help / color / mirror / Atom feed
* drivers/scsi/ufs/ufshpb.c:54:17: warning: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn') [clang-analyzer-core.NullDereference]
@ 2022-01-22 22:33 kernel test robot
  0 siblings, 0 replies; 5+ messages in thread
From: kernel test robot @ 2022-01-22 22:33 UTC (permalink / raw)
  To: kbuild

[-- Attachment #1: Type: text/plain, Size: 23895 bytes --]

CC: llvm(a)lists.linux.dev
CC: kbuild-all(a)lists.01.org
CC: linux-kernel(a)vger.kernel.org
TO: Daejun Park <daejun7.park@samsung.com>
CC: "Martin K. Petersen" <martin.petersen@oracle.com>
CC: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>
CC: Bart Van Assche <bvanassche@acm.org>
CC: Can Guo <cang@codeaurora.org>
CC: Bean Huo <beanhuo@micron.com>
CC: Stanley Chu <stanley.chu@mediatek.com>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   1c52283265a462a100ae63ddf58b4e5884acde86
commit: f02bc9754a6887bf5e286889265d24ce5e3b1952 scsi: ufs: ufshpb: Introduce Host Performance Buffer feature
date:   6 months ago
:::::: branch date: 13 hours ago
:::::: commit date: 6 months ago
config: riscv-randconfig-c006-20220122 (https://download.01.org/0day-ci/archive/20220123/202201230608.GaekbR7k-lkp(a)intel.com/config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 7b3d30728816403d1fd73cc5082e9fb761262bce)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # install riscv cross compiling tool for clang build
        # apt-get install binutils-riscv64-linux-gnu
        # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f02bc9754a6887bf5e286889265d24ce5e3b1952
        git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
        git fetch --no-tags linus master
        git checkout f02bc9754a6887bf5e286889265d24ce5e3b1952
        # save the config file to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=riscv clang-analyzer 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>


clang-analyzer warnings: (new ones prefixed by >>)
           ^
   include/linux/compiler_types.h:316:2: note: expanded from macro '_compiletime_assert'
           __compiletime_assert(condition, msg, prefix, suffix)
           ^
   include/linux/compiler_types.h:306:2: note: expanded from macro '__compiletime_assert'
           do {                                                            \
           ^
   drivers/scsi/scsi_debug.c:4969:2: note: Loop condition is false. Execution continues on line 4979
           list_for_each_entry(devip, &sdbg_host->dev_info_list, dev_list) {
           ^
   include/linux/list.h:628:2: note: expanded from macro 'list_for_each_entry'
           for (pos = list_first_entry(head, typeof(*pos), member);        \
           ^
   drivers/scsi/scsi_debug.c:4979:7: note: 'open_devip' is null
           if (!open_devip) { /* try and make a new one */
                ^~~~~~~~~~
   drivers/scsi/scsi_debug.c:4979:2: note: Taking true branch
           if (!open_devip) { /* try and make a new one */
           ^
   drivers/scsi/scsi_debug.c:4980:16: note: Calling 'sdebug_device_create'
                   open_devip = sdebug_device_create(sdbg_host, GFP_ATOMIC);
                                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/scsi_debug.c:4927:6: note: Assuming 'devip' is non-null
           if (devip) {
               ^~~~~
   drivers/scsi/scsi_debug.c:4927:2: note: Taking true branch
           if (devip) {
           ^
   drivers/scsi/scsi_debug.c:4928:7: note: Assuming 'sdebug_uuid_ctl' is not equal to 1
                   if (sdebug_uuid_ctl == 1)
                       ^~~~~~~~~~~~~~~~~~~~
   drivers/scsi/scsi_debug.c:4928:3: note: Taking false branch
                   if (sdebug_uuid_ctl == 1)
                   ^
   drivers/scsi/scsi_debug.c:4930:12: note: Assuming 'sdebug_uuid_ctl' is not equal to 2
                   else if (sdebug_uuid_ctl == 2) {
                            ^~~~~~~~~~~~~~~~~~~~
   drivers/scsi/scsi_debug.c:4930:8: note: Taking false branch
                   else if (sdebug_uuid_ctl == 2) {
                        ^
   drivers/scsi/scsi_debug.c:4940:7: note: Assuming 'sdeb_zbc_in_use' is true
                   if (sdeb_zbc_in_use) {
                       ^~~~~~~~~~~~~~~
   drivers/scsi/scsi_debug.c:4940:3: note: Taking true branch
                   if (sdeb_zbc_in_use) {
                   ^
   drivers/scsi/scsi_debug.c:4942:8: note: Calling 'sdebug_device_create_zones'
                           if (sdebug_device_create_zones(devip)) {
                               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/scsi_debug.c:4848:6: note: Assuming 'sdeb_zbc_zone_size_mb' is 0
           if (!sdeb_zbc_zone_size_mb) {
               ^~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/scsi_debug.c:4848:2: note: Taking true branch
           if (!sdeb_zbc_zone_size_mb) {
           ^
   drivers/scsi/scsi_debug.c:4850:7: note: '?' condition is false
                           >> ilog2(sdebug_sector_size);
                              ^
   include/linux/log2.h:158:2: note: expanded from macro 'ilog2'
           __builtin_constant_p(n) ?       \
           ^
   drivers/scsi/scsi_debug.c:4850:7: note: '?' condition is true
                           >> ilog2(sdebug_sector_size);
                              ^
   include/linux/log2.h:161:2: note: expanded from macro 'ilog2'
           (sizeof(n) <= 4) ?              \
           ^
   drivers/scsi/scsi_debug.c:4850:7: note: Calling '__ilog2_u32'
                           >> ilog2(sdebug_sector_size);
                              ^
   include/linux/log2.h:162:2: note: expanded from macro 'ilog2'
           __ilog2_u32(n) :                \
           ^~~~~~~~~~~~~~
   include/linux/log2.h:24:2: note: Returning the value -1
           return fls(n) - 1;
           ^~~~~~~~~~~~~~~~~
   drivers/scsi/scsi_debug.c:4850:7: note: Returning from '__ilog2_u32'
                           >> ilog2(sdebug_sector_size);
                              ^
   include/linux/log2.h:162:2: note: expanded from macro 'ilog2'
           __ilog2_u32(n) :                \
           ^~~~~~~~~~~~~~
   drivers/scsi/scsi_debug.c:4850:4: note: The result of the right shift is undefined because the right operand is negative
                           >> ilog2(sdebug_sector_size);
                           ^
   Suppressed 9 warnings (2 in non-user code, 7 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   10 warnings generated.
   Suppressed 10 warnings (3 in non-user code, 7 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   10 warnings generated.
   Suppressed 10 warnings (3 in non-user code, 7 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   10 warnings generated.
   Suppressed 10 warnings (3 in non-user code, 7 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   10 warnings generated.
   Suppressed 10 warnings (3 in non-user code, 7 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   14 warnings generated.
>> drivers/scsi/ufs/ufshpb.c:54:17: warning: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn') [clang-analyzer-core.NullDereference]
                   srgn->is_last = true;
                                 ^
   drivers/scsi/ufs/ufshpb.c:475:6: note: Assuming 'lun' is < field 'max_lu_supported'
           if (lun >= hba->dev_info.max_lu_supported)
               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:475:2: note: Taking false branch
           if (lun >= hba->dev_info.max_lu_supported)
           ^
   drivers/scsi/ufs/ufshpb.c:479:6: note: 'ret' is 0
           if (ret)
               ^~~
   drivers/scsi/ufs/ufshpb.c:479:2: note: Taking false branch
           if (ret)
           ^
   drivers/scsi/ufs/ufshpb.c:482:8: note: Calling 'ufshpb_alloc_hpb_lu'
           hpb = ufshpb_alloc_hpb_lu(hba, lun, &hba->ufshpb_dev,
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:257:6: note: Assuming 'hpb' is non-null
           if (!hpb)
               ^~~~
   drivers/scsi/ufs/ufshpb.c:257:2: note: Taking false branch
           if (!hpb)
           ^
   drivers/scsi/ufs/ufshpb.c:264:8: note: Calling 'ufshpb_lu_hpb_init'
           ret = ufshpb_lu_hpb_init(hba, hpb);
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:241:8: note: Calling 'ufshpb_alloc_region_tbl'
           ret = ufshpb_alloc_region_tbl(hba, hpb);
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:120:6: note: Assuming 'rgn_table' is non-null
           if (!rgn_table)
               ^~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:120:2: note: Taking false branch
           if (!rgn_table)
           ^
   drivers/scsi/ufs/ufshpb.c:125:20: note: Assuming 'rgn_idx' is < field 'rgns_per_lu'
           for (rgn_idx = 0; rgn_idx < hpb->rgns_per_lu; rgn_idx++) {
                             ^~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:125:2: note: Loop condition is true.  Entering loop body
           for (rgn_idx = 0; rgn_idx < hpb->rgns_per_lu; rgn_idx++) {
           ^
   drivers/scsi/ufs/ufshpb.c:132:7: note: Assuming the condition is true
                   if (rgn_idx == hpb->rgns_per_lu - 1) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:132:3: note: Taking true branch
                   if (rgn_idx == hpb->rgns_per_lu - 1) {
                   ^
   drivers/scsi/ufs/ufshpb.c:139:7: note: 'ret' is 0
                   if (ret)
                       ^~~
   drivers/scsi/ufs/ufshpb.c:139:3: note: Taking false branch
                   if (ret)
                   ^
   drivers/scsi/ufs/ufshpb.c:141:3: note: Calling 'ufshpb_init_subregion_tbl'
                   ufshpb_init_subregion_tbl(hpb, rgn, last_srgn);
                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:43:2: note: 'srgn' declared without an initial value
           struct ufshpb_subregion *srgn;
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:45:21: note: Assuming 'srgn_idx' is >= field 'srgn_cnt'
           for (srgn_idx = 0; srgn_idx < rgn->srgn_cnt; srgn_idx++) {
                              ^~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:45:2: note: Loop condition is false. Execution continues on line 53
           for (srgn_idx = 0; srgn_idx < rgn->srgn_cnt; srgn_idx++) {
           ^
   drivers/scsi/ufs/ufshpb.c:53:15: note: 'last' is true
           if (unlikely(last && hpb->last_srgn_entries))
                        ^
   include/linux/compiler.h:78:42: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                               ^
   drivers/scsi/ufs/ufshpb.c:53:15: note: Left side of '&&' is true
           if (unlikely(last && hpb->last_srgn_entries))
                        ^
   drivers/scsi/ufs/ufshpb.c:53:6: note: Assuming the condition is false
           if (unlikely(last && hpb->last_srgn_entries))
               ^
   include/linux/compiler.h:78:40: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                             ^~~~
   drivers/scsi/ufs/ufshpb.c:53:2: note: Taking true branch
           if (unlikely(last && hpb->last_srgn_entries))
           ^
   drivers/scsi/ufs/ufshpb.c:54:17: note: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn')
                   srgn->is_last = true;
                   ~~~~          ^
>> drivers/scsi/ufs/ufshpb.c:104:22: warning: Division by zero [clang-analyzer-core.DivideZero]
           hpb->srgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
                               ^
   include/linux/math.h:36:22: note: expanded from macro 'DIV_ROUND_UP'
   #define DIV_ROUND_UP __KERNEL_DIV_ROUND_UP
                        ^
   include/uapi/linux/const.h:34:54: note: expanded from macro '__KERNEL_DIV_ROUND_UP'
   #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
                                                        ^
   drivers/scsi/ufs/ufshpb.c:475:6: note: Assuming 'lun' is < field 'max_lu_supported'
           if (lun >= hba->dev_info.max_lu_supported)
               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:475:2: note: Taking false branch
           if (lun >= hba->dev_info.max_lu_supported)
           ^
   drivers/scsi/ufs/ufshpb.c:479:6: note: 'ret' is 0
           if (ret)
               ^~~
   drivers/scsi/ufs/ufshpb.c:479:2: note: Taking false branch
           if (ret)
           ^
   drivers/scsi/ufs/ufshpb.c:482:8: note: Calling 'ufshpb_alloc_hpb_lu'
           hpb = ufshpb_alloc_hpb_lu(hba, lun, &hba->ufshpb_dev,
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:257:6: note: Assuming 'hpb' is non-null
           if (!hpb)
               ^~~~
   drivers/scsi/ufs/ufshpb.c:257:2: note: Taking false branch
           if (!hpb)
           ^
   drivers/scsi/ufs/ufshpb.c:262:2: note: Calling 'ufshpb_lu_parameter_init'
           ufshpb_lu_parameter_init(hba, hpb, hpb_dev_info, hpb_lu_info);
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:78:23: note: Assuming field 'num_pinned' is 0
           hpb->lu_pinned_end = hpb_lu_info->num_pinned ?
                                ^~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:78:23: note: '?' condition is false
   drivers/scsi/ufs/ufshpb.c:91:31: note: '?' condition is false
           hpb->entries_per_rgn_shift = ilog2(entries_per_rgn);
                                        ^
   include/linux/log2.h:158:2: note: expanded from macro 'ilog2'
           __builtin_constant_p(n) ?       \
           ^
   drivers/scsi/ufs/ufshpb.c:91:31: note: '?' condition is true
           hpb->entries_per_rgn_shift = ilog2(entries_per_rgn);
                                        ^
   include/linux/log2.h:161:2: note: expanded from macro 'ilog2'
           (sizeof(n) <= 4) ?              \
           ^
   drivers/scsi/ufs/ufshpb.c:95:32: note: '?' condition is false
           hpb->entries_per_srgn_shift = ilog2(hpb->entries_per_srgn);
                                         ^
   include/linux/log2.h:158:2: note: expanded from macro 'ilog2'
           __builtin_constant_p(n) ?       \
           ^
   drivers/scsi/ufs/ufshpb.c:95:32: note: '?' condition is true
           hpb->entries_per_srgn_shift = ilog2(hpb->entries_per_srgn);
                                         ^
   include/linux/log2.h:161:2: note: expanded from macro 'ilog2'
           (sizeof(n) <= 4) ?              \
           ^
   drivers/scsi/ufs/ufshpb.c:104:22: note: Division by zero
           hpb->srgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
                               ^
   include/linux/math.h:36:22: note: expanded from macro 'DIV_ROUND_UP'
   #define DIV_ROUND_UP __KERNEL_DIV_ROUND_UP
                        ^
   include/uapi/linux/const.h:34:54: note: expanded from macro '__KERNEL_DIV_ROUND_UP'
   #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
                                        ~~~~~~~~~~~~~~~~^~~~~
   drivers/scsi/ufs/ufshpb.c:241:2: warning: Value stored to 'ret' is never read [clang-analyzer-deadcode.DeadStores]
           ret = ufshpb_alloc_region_tbl(hba, hpb);
           ^     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:241:2: note: Value stored to 'ret' is never read
           ret = ufshpb_alloc_region_tbl(hba, hpb);
           ^     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   Suppressed 11 warnings (3 in non-user code, 8 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   2 warnings generated.
   Suppressed 2 warnings (2 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   2 warnings generated.
   Suppressed 2 warnings (2 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   2 warnings generated.
   Suppressed 2 warnings (2 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   2 warnings generated.
   Suppressed 2 warnings (2 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   10 warnings generated.
   drivers/md/dm-cache-metadata.c:341:3: warning: Value stored to 'bdev_size' is never read [clang-analyzer-deadcode.DeadStores]
                   bdev_size = DM_CACHE_METADATA_MAX_SECTORS;
                   ^
   drivers/md/dm-cache-metadata.c:341:3: note: Value stored to 'bdev_size' is never read
   Suppressed 9 warnings (2 in non-user code, 7 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (2 in non-user code, 7 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.

vim +54 drivers/scsi/ufs/ufshpb.c

f02bc9754a6887 Daejun Park 2021-07-12   38  
f02bc9754a6887 Daejun Park 2021-07-12   39  static void ufshpb_init_subregion_tbl(struct ufshpb_lu *hpb,
f02bc9754a6887 Daejun Park 2021-07-12   40  				      struct ufshpb_region *rgn, bool last)
f02bc9754a6887 Daejun Park 2021-07-12   41  {
f02bc9754a6887 Daejun Park 2021-07-12   42  	int srgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   43  	struct ufshpb_subregion *srgn;
f02bc9754a6887 Daejun Park 2021-07-12   44  
f02bc9754a6887 Daejun Park 2021-07-12   45  	for (srgn_idx = 0; srgn_idx < rgn->srgn_cnt; srgn_idx++) {
f02bc9754a6887 Daejun Park 2021-07-12   46  		srgn = rgn->srgn_tbl + srgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   47  
f02bc9754a6887 Daejun Park 2021-07-12   48  		srgn->rgn_idx = rgn->rgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   49  		srgn->srgn_idx = srgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   50  		srgn->srgn_state = HPB_SRGN_UNUSED;
f02bc9754a6887 Daejun Park 2021-07-12   51  	}
f02bc9754a6887 Daejun Park 2021-07-12   52  
f02bc9754a6887 Daejun Park 2021-07-12   53  	if (unlikely(last && hpb->last_srgn_entries))
f02bc9754a6887 Daejun Park 2021-07-12  @54  		srgn->is_last = true;
f02bc9754a6887 Daejun Park 2021-07-12   55  }
f02bc9754a6887 Daejun Park 2021-07-12   56  
f02bc9754a6887 Daejun Park 2021-07-12   57  static int ufshpb_alloc_subregion_tbl(struct ufshpb_lu *hpb,
f02bc9754a6887 Daejun Park 2021-07-12   58  				      struct ufshpb_region *rgn, int srgn_cnt)
f02bc9754a6887 Daejun Park 2021-07-12   59  {
f02bc9754a6887 Daejun Park 2021-07-12   60  	rgn->srgn_tbl = kvcalloc(srgn_cnt, sizeof(struct ufshpb_subregion),
f02bc9754a6887 Daejun Park 2021-07-12   61  				 GFP_KERNEL);
f02bc9754a6887 Daejun Park 2021-07-12   62  	if (!rgn->srgn_tbl)
f02bc9754a6887 Daejun Park 2021-07-12   63  		return -ENOMEM;
f02bc9754a6887 Daejun Park 2021-07-12   64  
f02bc9754a6887 Daejun Park 2021-07-12   65  	rgn->srgn_cnt = srgn_cnt;
f02bc9754a6887 Daejun Park 2021-07-12   66  	return 0;
f02bc9754a6887 Daejun Park 2021-07-12   67  }
f02bc9754a6887 Daejun Park 2021-07-12   68  
f02bc9754a6887 Daejun Park 2021-07-12   69  static void ufshpb_lu_parameter_init(struct ufs_hba *hba,
f02bc9754a6887 Daejun Park 2021-07-12   70  				     struct ufshpb_lu *hpb,
f02bc9754a6887 Daejun Park 2021-07-12   71  				     struct ufshpb_dev_info *hpb_dev_info,
f02bc9754a6887 Daejun Park 2021-07-12   72  				     struct ufshpb_lu_info *hpb_lu_info)
f02bc9754a6887 Daejun Park 2021-07-12   73  {
f02bc9754a6887 Daejun Park 2021-07-12   74  	u32 entries_per_rgn;
f02bc9754a6887 Daejun Park 2021-07-12   75  	u64 rgn_mem_size, tmp;
f02bc9754a6887 Daejun Park 2021-07-12   76  
f02bc9754a6887 Daejun Park 2021-07-12   77  	hpb->lu_pinned_start = hpb_lu_info->pinned_start;
f02bc9754a6887 Daejun Park 2021-07-12   78  	hpb->lu_pinned_end = hpb_lu_info->num_pinned ?
f02bc9754a6887 Daejun Park 2021-07-12   79  		(hpb_lu_info->pinned_start + hpb_lu_info->num_pinned - 1)
f02bc9754a6887 Daejun Park 2021-07-12   80  		: PINNED_NOT_SET;
f02bc9754a6887 Daejun Park 2021-07-12   81  
f02bc9754a6887 Daejun Park 2021-07-12   82  	rgn_mem_size = (1ULL << hpb_dev_info->rgn_size) * HPB_RGN_SIZE_UNIT
f02bc9754a6887 Daejun Park 2021-07-12   83  			* HPB_ENTRY_SIZE;
f02bc9754a6887 Daejun Park 2021-07-12   84  	do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12   85  	hpb->srgn_mem_size = (1ULL << hpb_dev_info->srgn_size)
f02bc9754a6887 Daejun Park 2021-07-12   86  		* HPB_RGN_SIZE_UNIT / HPB_ENTRY_BLOCK_SIZE * HPB_ENTRY_SIZE;
f02bc9754a6887 Daejun Park 2021-07-12   87  
f02bc9754a6887 Daejun Park 2021-07-12   88  	tmp = rgn_mem_size;
f02bc9754a6887 Daejun Park 2021-07-12   89  	do_div(tmp, HPB_ENTRY_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12   90  	entries_per_rgn = (u32)tmp;
f02bc9754a6887 Daejun Park 2021-07-12   91  	hpb->entries_per_rgn_shift = ilog2(entries_per_rgn);
f02bc9754a6887 Daejun Park 2021-07-12   92  	hpb->entries_per_rgn_mask = entries_per_rgn - 1;
f02bc9754a6887 Daejun Park 2021-07-12   93  
f02bc9754a6887 Daejun Park 2021-07-12   94  	hpb->entries_per_srgn = hpb->srgn_mem_size / HPB_ENTRY_SIZE;
f02bc9754a6887 Daejun Park 2021-07-12   95  	hpb->entries_per_srgn_shift = ilog2(hpb->entries_per_srgn);
f02bc9754a6887 Daejun Park 2021-07-12   96  	hpb->entries_per_srgn_mask = hpb->entries_per_srgn - 1;
f02bc9754a6887 Daejun Park 2021-07-12   97  
f02bc9754a6887 Daejun Park 2021-07-12   98  	tmp = rgn_mem_size;
f02bc9754a6887 Daejun Park 2021-07-12   99  	do_div(tmp, hpb->srgn_mem_size);
f02bc9754a6887 Daejun Park 2021-07-12  100  	hpb->srgns_per_rgn = (int)tmp;
f02bc9754a6887 Daejun Park 2021-07-12  101  
f02bc9754a6887 Daejun Park 2021-07-12  102  	hpb->rgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
f02bc9754a6887 Daejun Park 2021-07-12  103  				entries_per_rgn);
f02bc9754a6887 Daejun Park 2021-07-12 @104  	hpb->srgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
f02bc9754a6887 Daejun Park 2021-07-12  105  				(hpb->srgn_mem_size / HPB_ENTRY_SIZE));
f02bc9754a6887 Daejun Park 2021-07-12  106  	hpb->last_srgn_entries = hpb_lu_info->num_blocks
f02bc9754a6887 Daejun Park 2021-07-12  107  				 % (hpb->srgn_mem_size / HPB_ENTRY_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12  108  
f02bc9754a6887 Daejun Park 2021-07-12  109  	hpb->pages_per_srgn = DIV_ROUND_UP(hpb->srgn_mem_size, PAGE_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12  110  }
f02bc9754a6887 Daejun Park 2021-07-12  111  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

^ permalink raw reply	[flat|nested] 5+ messages in thread

* drivers/scsi/ufs/ufshpb.c:54:17: warning: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn') [clang-analyzer-core.NullDereference]
@ 2022-05-08  5:44 kernel test robot
  0 siblings, 0 replies; 5+ messages in thread
From: kernel test robot @ 2022-05-08  5:44 UTC (permalink / raw)
  To: kbuild

[-- Attachment #1: Type: text/plain, Size: 24560 bytes --]

CC: llvm(a)lists.linux.dev
CC: kbuild-all(a)lists.01.org
BCC: lkp(a)intel.com
CC: linux-kernel(a)vger.kernel.org
TO: Daejun Park <daejun7.park@samsung.com>
CC: "Martin K. Petersen" <martin.petersen@oracle.com>
CC: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>
CC: Bart Van Assche <bvanassche@acm.org>
CC: Can Guo <cang@codeaurora.org>
CC: Bean Huo <beanhuo@micron.com>
CC: Stanley Chu <stanley.chu@mediatek.com>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   30c8e80f79329617012f07b09b70114592092ea4
commit: f02bc9754a6887bf5e286889265d24ce5e3b1952 scsi: ufs: ufshpb: Introduce Host Performance Buffer feature
date:   9 months ago
:::::: branch date: 12 hours ago
:::::: commit date: 9 months ago
config: arm-randconfig-c002-20220507 (https://download.01.org/0day-ci/archive/20220508/202205081338.nISwMDHQ-lkp(a)intel.com/config)
compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project af4cf1c6b8ed0d8102fc5e69acdc2fcbbcdaa9a7)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # install arm cross compiling tool for clang build
        # apt-get install binutils-arm-linux-gnueabi
        # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f02bc9754a6887bf5e286889265d24ce5e3b1952
        git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
        git fetch --no-tags linus master
        git checkout f02bc9754a6887bf5e286889265d24ce5e3b1952
        # save the config file
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm clang-analyzer 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>


clang-analyzer warnings: (new ones prefixed by >>)
   include/linux/compiler_types.h:316:2: note: expanded from macro '_compiletime_assert'
           __compiletime_assert(condition, msg, prefix, suffix)
           ^
   include/linux/compiler_types.h:308:3: note: expanded from macro '__compiletime_assert'
                   if (!(condition))                                       \
                   ^
   drivers/gpu/drm/drm_file.c:584:8: note: Loop condition is false.  Exiting loop
                           e = list_first_entry(&file_priv->event_list,
                               ^
   include/linux/list.h:522:2: note: expanded from macro 'list_first_entry'
           list_entry((ptr)->next, type, member)
           ^
   include/linux/list.h:511:2: note: expanded from macro 'list_entry'
           container_of(ptr, type, member)
           ^
   include/linux/kernel.h:495:2: note: expanded from macro 'container_of'
           BUILD_BUG_ON_MSG(!__same_type(*(ptr), ((type *)0)->member) &&   \
           ^
   note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
   include/linux/compiler_types.h:328:2: note: expanded from macro 'compiletime_assert'
           _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
           ^
   include/linux/compiler_types.h:316:2: note: expanded from macro '_compiletime_assert'
           __compiletime_assert(condition, msg, prefix, suffix)
           ^
   include/linux/compiler_types.h:306:2: note: expanded from macro '__compiletime_assert'
           do {                                                            \
           ^
   drivers/gpu/drm/drm_file.c:586:30: note: Use of memory after it is freed
                           file_priv->event_space += e->event->length;
                                                     ^~~~~~~~
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   12 warnings generated.
   Suppressed 12 warnings (10 in non-user code, 2 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   12 warnings generated.
   Suppressed 12 warnings (10 in non-user code, 2 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   12 warnings generated.
   Suppressed 12 warnings (10 in non-user code, 2 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   12 warnings generated.
   Suppressed 12 warnings (10 in non-user code, 2 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   12 warnings generated.
   Suppressed 12 warnings (10 in non-user code, 2 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   12 warnings generated.
   Suppressed 12 warnings (10 in non-user code, 2 with check filters).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   13 warnings generated.
>> drivers/scsi/ufs/ufshpb.c:54:17: warning: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn') [clang-analyzer-core.NullDereference]
                   srgn->is_last = true;
                                 ^
   drivers/scsi/ufs/ufshpb.c:475:6: note: Assuming 'lun' is < field 'max_lu_supported'
           if (lun >= hba->dev_info.max_lu_supported)
               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:475:2: note: Taking false branch
           if (lun >= hba->dev_info.max_lu_supported)
           ^
   drivers/scsi/ufs/ufshpb.c:479:6: note: 'ret' is 0
           if (ret)
               ^~~
   drivers/scsi/ufs/ufshpb.c:479:2: note: Taking false branch
           if (ret)
           ^
   drivers/scsi/ufs/ufshpb.c:482:8: note: Calling 'ufshpb_alloc_hpb_lu'
           hpb = ufshpb_alloc_hpb_lu(hba, lun, &hba->ufshpb_dev,
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:257:6: note: Assuming 'hpb' is non-null
           if (!hpb)
               ^~~~
   drivers/scsi/ufs/ufshpb.c:257:2: note: Taking false branch
           if (!hpb)
           ^
   drivers/scsi/ufs/ufshpb.c:264:8: note: Calling 'ufshpb_lu_hpb_init'
           ret = ufshpb_lu_hpb_init(hba, hpb);
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:241:8: note: Calling 'ufshpb_alloc_region_tbl'
           ret = ufshpb_alloc_region_tbl(hba, hpb);
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:120:6: note: Assuming 'rgn_table' is non-null
           if (!rgn_table)
               ^~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:120:2: note: Taking false branch
           if (!rgn_table)
           ^
   drivers/scsi/ufs/ufshpb.c:125:20: note: Assuming 'rgn_idx' is < field 'rgns_per_lu'
           for (rgn_idx = 0; rgn_idx < hpb->rgns_per_lu; rgn_idx++) {
                             ^~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:125:2: note: Loop condition is true.  Entering loop body
           for (rgn_idx = 0; rgn_idx < hpb->rgns_per_lu; rgn_idx++) {
           ^
   drivers/scsi/ufs/ufshpb.c:132:7: note: Assuming the condition is true
                   if (rgn_idx == hpb->rgns_per_lu - 1) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:132:3: note: Taking true branch
                   if (rgn_idx == hpb->rgns_per_lu - 1) {
                   ^
   drivers/scsi/ufs/ufshpb.c:139:7: note: 'ret' is 0
                   if (ret)
                       ^~~
   drivers/scsi/ufs/ufshpb.c:139:3: note: Taking false branch
                   if (ret)
                   ^
   drivers/scsi/ufs/ufshpb.c:141:3: note: Calling 'ufshpb_init_subregion_tbl'
                   ufshpb_init_subregion_tbl(hpb, rgn, last_srgn);
                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:43:2: note: 'srgn' declared without an initial value
           struct ufshpb_subregion *srgn;
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:45:21: note: Assuming 'srgn_idx' is >= field 'srgn_cnt'
           for (srgn_idx = 0; srgn_idx < rgn->srgn_cnt; srgn_idx++) {
                              ^~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:45:2: note: Loop condition is false. Execution continues on line 53
           for (srgn_idx = 0; srgn_idx < rgn->srgn_cnt; srgn_idx++) {
           ^
   drivers/scsi/ufs/ufshpb.c:53:15: note: 'last' is true
           if (unlikely(last && hpb->last_srgn_entries))
                        ^
   include/linux/compiler.h:78:42: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                               ^
   drivers/scsi/ufs/ufshpb.c:53:15: note: Left side of '&&' is true
           if (unlikely(last && hpb->last_srgn_entries))
                        ^
   drivers/scsi/ufs/ufshpb.c:53:6: note: Assuming the condition is false
           if (unlikely(last && hpb->last_srgn_entries))
               ^
   include/linux/compiler.h:78:40: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                             ^~~~
   drivers/scsi/ufs/ufshpb.c:53:2: note: Taking true branch
           if (unlikely(last && hpb->last_srgn_entries))
           ^
   drivers/scsi/ufs/ufshpb.c:54:17: note: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn')
                   srgn->is_last = true;
                   ~~~~          ^
>> drivers/scsi/ufs/ufshpb.c:104:22: warning: Division by zero [clang-analyzer-core.DivideZero]
           hpb->srgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
                               ^
   include/linux/math.h:36:22: note: expanded from macro 'DIV_ROUND_UP'
   #define DIV_ROUND_UP __KERNEL_DIV_ROUND_UP
                        ^
   include/uapi/linux/const.h:34:54: note: expanded from macro '__KERNEL_DIV_ROUND_UP'
   #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
                                        ~~~~~~~~~~~~~~~~^~~~~
   drivers/scsi/ufs/ufshpb.c:78:23: note: Assuming field 'num_pinned' is 0
           hpb->lu_pinned_end = hpb_lu_info->num_pinned ?
                                ^~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:78:23: note: '?' condition is false
   drivers/scsi/ufs/ufshpb.c:84:2: note: Left side of '&&' is false
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:229:35: note: expanded from macro 'do_div'
           if (__builtin_constant_p(__base) &&             \
                                            ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: 4 is >= 4
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^~~~~~~~~~~~~~~~~~~~~
   arch/arm/include/asm/div64.h:64:32: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                  ^~~~~~~~
   note: expanded from here
   drivers/scsi/ufs/ufshpb.c:84:2: note: Left side of '&&' is true
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^
   arch/arm/include/asm/div64.h:64:31: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                 ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: Left side of '&&' is false
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:234:35: note: expanded from macro 'do_div'
                      __builtin_constant_p(__base) &&      \
                                                   ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: Assuming the condition is true
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:241:20: note: expanded from macro 'do_div'
           } else if (likely(((n) >> 32) == 0)) {          \
                      ~~~~~~~^~~~~~~~~~~~~~~~~
   include/linux/compiler.h:77:40: note: expanded from macro 'likely'
   # define likely(x)      __builtin_expect(!!(x), 1)
                                               ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: Taking true branch
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:241:9: note: expanded from macro 'do_div'
           } else if (likely(((n) >> 32) == 0)) {          \
                  ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Left side of '&&' is false
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:229:35: note: expanded from macro 'do_div'
           if (__builtin_constant_p(__base) &&             \
                                            ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: 4 is >= 4
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^~~~~~~~~~~~~~~~~~~~~
   arch/arm/include/asm/div64.h:64:32: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                  ^~~~~~~~
   note: expanded from here
   drivers/scsi/ufs/ufshpb.c:89:2: note: Left side of '&&' is true
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^
   arch/arm/include/asm/div64.h:64:31: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                 ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Left side of '&&' is false
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:234:35: note: expanded from macro 'do_div'
                      __builtin_constant_p(__base) &&      \
                                                   ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Assuming the condition is true
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:241:20: note: expanded from macro 'do_div'
           } else if (likely(((n) >> 32) == 0)) {          \
                      ~~~~~~~^~~~~~~~~~~~~~~~~
   include/linux/compiler.h:77:40: note: expanded from macro 'likely'
   # define likely(x)      __builtin_expect(!!(x), 1)
                                               ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Taking true branch
           do_div(tmp, HPB_ENTRY_SIZE);

vim +54 drivers/scsi/ufs/ufshpb.c

f02bc9754a6887 Daejun Park 2021-07-12   38  
f02bc9754a6887 Daejun Park 2021-07-12   39  static void ufshpb_init_subregion_tbl(struct ufshpb_lu *hpb,
f02bc9754a6887 Daejun Park 2021-07-12   40  				      struct ufshpb_region *rgn, bool last)
f02bc9754a6887 Daejun Park 2021-07-12   41  {
f02bc9754a6887 Daejun Park 2021-07-12   42  	int srgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   43  	struct ufshpb_subregion *srgn;
f02bc9754a6887 Daejun Park 2021-07-12   44  
f02bc9754a6887 Daejun Park 2021-07-12   45  	for (srgn_idx = 0; srgn_idx < rgn->srgn_cnt; srgn_idx++) {
f02bc9754a6887 Daejun Park 2021-07-12   46  		srgn = rgn->srgn_tbl + srgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   47  
f02bc9754a6887 Daejun Park 2021-07-12   48  		srgn->rgn_idx = rgn->rgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   49  		srgn->srgn_idx = srgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   50  		srgn->srgn_state = HPB_SRGN_UNUSED;
f02bc9754a6887 Daejun Park 2021-07-12   51  	}
f02bc9754a6887 Daejun Park 2021-07-12   52  
f02bc9754a6887 Daejun Park 2021-07-12   53  	if (unlikely(last && hpb->last_srgn_entries))
f02bc9754a6887 Daejun Park 2021-07-12  @54  		srgn->is_last = true;
f02bc9754a6887 Daejun Park 2021-07-12   55  }
f02bc9754a6887 Daejun Park 2021-07-12   56  
f02bc9754a6887 Daejun Park 2021-07-12   57  static int ufshpb_alloc_subregion_tbl(struct ufshpb_lu *hpb,
f02bc9754a6887 Daejun Park 2021-07-12   58  				      struct ufshpb_region *rgn, int srgn_cnt)
f02bc9754a6887 Daejun Park 2021-07-12   59  {
f02bc9754a6887 Daejun Park 2021-07-12   60  	rgn->srgn_tbl = kvcalloc(srgn_cnt, sizeof(struct ufshpb_subregion),
f02bc9754a6887 Daejun Park 2021-07-12   61  				 GFP_KERNEL);
f02bc9754a6887 Daejun Park 2021-07-12   62  	if (!rgn->srgn_tbl)
f02bc9754a6887 Daejun Park 2021-07-12   63  		return -ENOMEM;
f02bc9754a6887 Daejun Park 2021-07-12   64  
f02bc9754a6887 Daejun Park 2021-07-12   65  	rgn->srgn_cnt = srgn_cnt;
f02bc9754a6887 Daejun Park 2021-07-12   66  	return 0;
f02bc9754a6887 Daejun Park 2021-07-12   67  }
f02bc9754a6887 Daejun Park 2021-07-12   68  
f02bc9754a6887 Daejun Park 2021-07-12   69  static void ufshpb_lu_parameter_init(struct ufs_hba *hba,
f02bc9754a6887 Daejun Park 2021-07-12   70  				     struct ufshpb_lu *hpb,
f02bc9754a6887 Daejun Park 2021-07-12   71  				     struct ufshpb_dev_info *hpb_dev_info,
f02bc9754a6887 Daejun Park 2021-07-12   72  				     struct ufshpb_lu_info *hpb_lu_info)
f02bc9754a6887 Daejun Park 2021-07-12   73  {
f02bc9754a6887 Daejun Park 2021-07-12   74  	u32 entries_per_rgn;
f02bc9754a6887 Daejun Park 2021-07-12   75  	u64 rgn_mem_size, tmp;
f02bc9754a6887 Daejun Park 2021-07-12   76  
f02bc9754a6887 Daejun Park 2021-07-12   77  	hpb->lu_pinned_start = hpb_lu_info->pinned_start;
f02bc9754a6887 Daejun Park 2021-07-12   78  	hpb->lu_pinned_end = hpb_lu_info->num_pinned ?
f02bc9754a6887 Daejun Park 2021-07-12   79  		(hpb_lu_info->pinned_start + hpb_lu_info->num_pinned - 1)
f02bc9754a6887 Daejun Park 2021-07-12   80  		: PINNED_NOT_SET;
f02bc9754a6887 Daejun Park 2021-07-12   81  
f02bc9754a6887 Daejun Park 2021-07-12   82  	rgn_mem_size = (1ULL << hpb_dev_info->rgn_size) * HPB_RGN_SIZE_UNIT
f02bc9754a6887 Daejun Park 2021-07-12   83  			* HPB_ENTRY_SIZE;
f02bc9754a6887 Daejun Park 2021-07-12   84  	do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12   85  	hpb->srgn_mem_size = (1ULL << hpb_dev_info->srgn_size)
f02bc9754a6887 Daejun Park 2021-07-12   86  		* HPB_RGN_SIZE_UNIT / HPB_ENTRY_BLOCK_SIZE * HPB_ENTRY_SIZE;
f02bc9754a6887 Daejun Park 2021-07-12   87  
f02bc9754a6887 Daejun Park 2021-07-12   88  	tmp = rgn_mem_size;
f02bc9754a6887 Daejun Park 2021-07-12   89  	do_div(tmp, HPB_ENTRY_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12   90  	entries_per_rgn = (u32)tmp;
f02bc9754a6887 Daejun Park 2021-07-12   91  	hpb->entries_per_rgn_shift = ilog2(entries_per_rgn);
f02bc9754a6887 Daejun Park 2021-07-12   92  	hpb->entries_per_rgn_mask = entries_per_rgn - 1;
f02bc9754a6887 Daejun Park 2021-07-12   93  
f02bc9754a6887 Daejun Park 2021-07-12   94  	hpb->entries_per_srgn = hpb->srgn_mem_size / HPB_ENTRY_SIZE;
f02bc9754a6887 Daejun Park 2021-07-12   95  	hpb->entries_per_srgn_shift = ilog2(hpb->entries_per_srgn);
f02bc9754a6887 Daejun Park 2021-07-12   96  	hpb->entries_per_srgn_mask = hpb->entries_per_srgn - 1;
f02bc9754a6887 Daejun Park 2021-07-12   97  
f02bc9754a6887 Daejun Park 2021-07-12   98  	tmp = rgn_mem_size;
f02bc9754a6887 Daejun Park 2021-07-12   99  	do_div(tmp, hpb->srgn_mem_size);
f02bc9754a6887 Daejun Park 2021-07-12  100  	hpb->srgns_per_rgn = (int)tmp;
f02bc9754a6887 Daejun Park 2021-07-12  101  
f02bc9754a6887 Daejun Park 2021-07-12  102  	hpb->rgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
f02bc9754a6887 Daejun Park 2021-07-12  103  				entries_per_rgn);
f02bc9754a6887 Daejun Park 2021-07-12 @104  	hpb->srgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
f02bc9754a6887 Daejun Park 2021-07-12  105  				(hpb->srgn_mem_size / HPB_ENTRY_SIZE));
f02bc9754a6887 Daejun Park 2021-07-12  106  	hpb->last_srgn_entries = hpb_lu_info->num_blocks
f02bc9754a6887 Daejun Park 2021-07-12  107  				 % (hpb->srgn_mem_size / HPB_ENTRY_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12  108  
f02bc9754a6887 Daejun Park 2021-07-12  109  	hpb->pages_per_srgn = DIV_ROUND_UP(hpb->srgn_mem_size, PAGE_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12  110  }
f02bc9754a6887 Daejun Park 2021-07-12  111  

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp

^ permalink raw reply	[flat|nested] 5+ messages in thread

* drivers/scsi/ufs/ufshpb.c:54:17: warning: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn') [clang-analyzer-core.NullDereference]
@ 2022-04-11  0:04 kernel test robot
  0 siblings, 0 replies; 5+ messages in thread
From: kernel test robot @ 2022-04-11  0:04 UTC (permalink / raw)
  To: kbuild

[-- Attachment #1: Type: text/plain, Size: 23497 bytes --]

CC: llvm(a)lists.linux.dev
CC: kbuild-all(a)lists.01.org
BCC: lkp(a)intel.com
CC: linux-kernel(a)vger.kernel.org
TO: Daejun Park <daejun7.park@samsung.com>
CC: "Martin K. Petersen" <martin.petersen@oracle.com>
CC: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>
CC: Bart Van Assche <bvanassche@acm.org>
CC: Can Guo <cang@codeaurora.org>
CC: Bean Huo <beanhuo@micron.com>
CC: Stanley Chu <stanley.chu@mediatek.com>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   4ea3c6425269d33da53c79d539ce9554117cf4d4
commit: f02bc9754a6887bf5e286889265d24ce5e3b1952 scsi: ufs: ufshpb: Introduce Host Performance Buffer feature
date:   8 months ago
:::::: branch date: 6 hours ago
:::::: commit date: 8 months ago
config: arm-randconfig-c002-20220410 (https://download.01.org/0day-ci/archive/20220411/202204110819.kuDfJPsr-lkp(a)intel.com/config)
compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project 256c6b0ba14e8a7ab6373b61b7193ea8c0a3651c)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # install arm cross compiling tool for clang build
        # apt-get install binutils-arm-linux-gnueabi
        # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f02bc9754a6887bf5e286889265d24ce5e3b1952
        git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
        git fetch --no-tags linus master
        git checkout f02bc9754a6887bf5e286889265d24ce5e3b1952
        # save the config file to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm clang-analyzer 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>


clang-analyzer warnings: (new ones prefixed by >>)
           INIT_LIST_HEAD(&pages);
           ^~~~~~~~~~~~~~~~~~~~~~
   drivers/dma-buf/heaps/system_heap.c:361:9: note: Assuming 'size_remaining' is <= 0
           while (size_remaining > 0) {
                  ^~~~~~~~~~~~~~~~~~
   drivers/dma-buf/heaps/system_heap.c:361:2: note: Loop condition is false. Execution continues on line 381
           while (size_remaining > 0) {
           ^
   drivers/dma-buf/heaps/system_heap.c:382:6: note: Assuming the condition is true
           if (sg_alloc_table(table, i, GFP_KERNEL))
               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/dma-buf/heaps/system_heap.c:382:2: note: Taking true branch
           if (sg_alloc_table(table, i, GFP_KERNEL))
           ^
   drivers/dma-buf/heaps/system_heap.c:383:3: note: Control jumps to line 413
                   goto free_buffer;
                   ^
   drivers/dma-buf/heaps/system_heap.c:413:2: note: Left side of '&&' is false
           list_for_each_entry_safe(page, tmp_page, &pages, lru)
           ^
   include/linux/list.h:715:13: note: expanded from macro 'list_for_each_entry_safe'
           for (pos = list_first_entry(head, typeof(*pos), member),        \
                      ^
   include/linux/list.h:522:2: note: expanded from macro 'list_first_entry'
           list_entry((ptr)->next, type, member)
           ^
   include/linux/list.h:511:2: note: expanded from macro 'list_entry'
           container_of(ptr, type, member)
           ^
   include/linux/kernel.h:495:61: note: expanded from macro 'container_of'
           BUILD_BUG_ON_MSG(!__same_type(*(ptr), ((type *)0)->member) &&   \
                                                                      ^
   drivers/dma-buf/heaps/system_heap.c:413:2: note: Taking false branch
           list_for_each_entry_safe(page, tmp_page, &pages, lru)
           ^
   include/linux/list.h:715:13: note: expanded from macro 'list_for_each_entry_safe'
           for (pos = list_first_entry(head, typeof(*pos), member),        \
                      ^
   include/linux/list.h:522:2: note: expanded from macro 'list_first_entry'
           list_entry((ptr)->next, type, member)
           ^
   include/linux/list.h:511:2: note: expanded from macro 'list_entry'
           container_of(ptr, type, member)
           ^
   note: (skipping 2 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
   include/linux/compiler_types.h:328:2: note: expanded from macro 'compiletime_assert'
           _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
           ^
   include/linux/compiler_types.h:316:2: note: expanded from macro '_compiletime_assert'
           __compiletime_assert(condition, msg, prefix, suffix)
           ^
   include/linux/compiler_types.h:308:3: note: expanded from macro '__compiletime_assert'
                   if (!(condition))                                       \
                   ^
   drivers/dma-buf/heaps/system_heap.c:413:2: note: Loop condition is false.  Exiting loop
           list_for_each_entry_safe(page, tmp_page, &pages, lru)
           ^
   include/linux/list.h:715:13: note: expanded from macro 'list_for_each_entry_safe'
           for (pos = list_first_entry(head, typeof(*pos), member),        \
                      ^
   include/linux/list.h:522:2: note: expanded from macro 'list_first_entry'
           list_entry((ptr)->next, type, member)
           ^
   include/linux/list.h:511:2: note: expanded from macro 'list_entry'
           container_of(ptr, type, member)
           ^
   note: (skipping 2 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
   include/linux/compiler_types.h:328:2: note: expanded from macro 'compiletime_assert'
           _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
           ^
   include/linux/compiler_types.h:316:2: note: expanded from macro '_compiletime_assert'
           __compiletime_assert(condition, msg, prefix, suffix)
           ^
   include/linux/compiler_types.h:306:2: note: expanded from macro '__compiletime_assert'
           do {                                                            \
           ^
   drivers/dma-buf/heaps/system_heap.c:413:2: note: Assigned value is garbage or undefined
           list_for_each_entry_safe(page, tmp_page, &pages, lru)
           ^
   include/linux/list.h:716:7: note: expanded from macro 'list_for_each_entry_safe'
                   n = list_next_entry(pos, member);                       \
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/list.h:555:2: note: expanded from macro 'list_next_entry'
           list_entry((pos)->member.next, typeof(*(pos)), member)
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/list.h:511:2: note: expanded from macro 'list_entry'
           container_of(ptr, type, member)
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/kernel.h:494:2: note: expanded from macro 'container_of'
           void *__mptr = (void *)(ptr);                                   \
           ^              ~~~~~~~~~~~~~
   Suppressed 2 warnings (2 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   4 warnings generated.
   Suppressed 4 warnings (4 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   4 warnings generated.
   Suppressed 4 warnings (4 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   8 warnings generated.
>> drivers/scsi/ufs/ufshpb.c:54:17: warning: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn') [clang-analyzer-core.NullDereference]
                   srgn->is_last = true;
                                 ^
   drivers/scsi/ufs/ufshpb.c:475:6: note: Assuming 'lun' is < field 'max_lu_supported'
           if (lun >= hba->dev_info.max_lu_supported)
               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:475:2: note: Taking false branch
           if (lun >= hba->dev_info.max_lu_supported)
           ^
   drivers/scsi/ufs/ufshpb.c:479:6: note: 'ret' is 0
           if (ret)
               ^~~
   drivers/scsi/ufs/ufshpb.c:479:2: note: Taking false branch
           if (ret)
           ^
   drivers/scsi/ufs/ufshpb.c:482:8: note: Calling 'ufshpb_alloc_hpb_lu'
           hpb = ufshpb_alloc_hpb_lu(hba, lun, &hba->ufshpb_dev,
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:257:6: note: Assuming 'hpb' is non-null
           if (!hpb)
               ^~~~
   drivers/scsi/ufs/ufshpb.c:257:2: note: Taking false branch
           if (!hpb)
           ^
   drivers/scsi/ufs/ufshpb.c:264:8: note: Calling 'ufshpb_lu_hpb_init'
           ret = ufshpb_lu_hpb_init(hba, hpb);
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:241:8: note: Calling 'ufshpb_alloc_region_tbl'
           ret = ufshpb_alloc_region_tbl(hba, hpb);
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:120:6: note: Assuming 'rgn_table' is non-null
           if (!rgn_table)
               ^~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:120:2: note: Taking false branch
           if (!rgn_table)
           ^
   drivers/scsi/ufs/ufshpb.c:125:20: note: Assuming 'rgn_idx' is < field 'rgns_per_lu'
           for (rgn_idx = 0; rgn_idx < hpb->rgns_per_lu; rgn_idx++) {
                             ^~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:125:2: note: Loop condition is true.  Entering loop body
           for (rgn_idx = 0; rgn_idx < hpb->rgns_per_lu; rgn_idx++) {
           ^
   drivers/scsi/ufs/ufshpb.c:132:7: note: Assuming the condition is true
                   if (rgn_idx == hpb->rgns_per_lu - 1) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:132:3: note: Taking true branch
                   if (rgn_idx == hpb->rgns_per_lu - 1) {
                   ^
   drivers/scsi/ufs/ufshpb.c:139:7: note: 'ret' is 0
                   if (ret)
                       ^~~
   drivers/scsi/ufs/ufshpb.c:139:3: note: Taking false branch
                   if (ret)
                   ^
   drivers/scsi/ufs/ufshpb.c:141:3: note: Calling 'ufshpb_init_subregion_tbl'
                   ufshpb_init_subregion_tbl(hpb, rgn, last_srgn);
                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:43:2: note: 'srgn' declared without an initial value
           struct ufshpb_subregion *srgn;
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:45:21: note: Assuming 'srgn_idx' is >= field 'srgn_cnt'
           for (srgn_idx = 0; srgn_idx < rgn->srgn_cnt; srgn_idx++) {
                              ^~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:45:2: note: Loop condition is false. Execution continues on line 53
           for (srgn_idx = 0; srgn_idx < rgn->srgn_cnt; srgn_idx++) {
           ^
   drivers/scsi/ufs/ufshpb.c:53:15: note: 'last' is true
           if (unlikely(last && hpb->last_srgn_entries))
                        ^
   include/linux/compiler.h:78:42: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                               ^
   drivers/scsi/ufs/ufshpb.c:53:15: note: Left side of '&&' is true
           if (unlikely(last && hpb->last_srgn_entries))
                        ^
   drivers/scsi/ufs/ufshpb.c:53:6: note: Assuming the condition is false
           if (unlikely(last && hpb->last_srgn_entries))
               ^
   include/linux/compiler.h:78:40: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                             ^~~~
   drivers/scsi/ufs/ufshpb.c:53:2: note: Taking true branch
           if (unlikely(last && hpb->last_srgn_entries))
           ^
   drivers/scsi/ufs/ufshpb.c:54:17: note: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn')
                   srgn->is_last = true;
                   ~~~~          ^
>> drivers/scsi/ufs/ufshpb.c:104:22: warning: Division by zero [clang-analyzer-core.DivideZero]
           hpb->srgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
                               ^
   include/linux/math.h:36:22: note: expanded from macro 'DIV_ROUND_UP'
   #define DIV_ROUND_UP __KERNEL_DIV_ROUND_UP
                        ^
   include/uapi/linux/const.h:34:54: note: expanded from macro '__KERNEL_DIV_ROUND_UP'
   #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
                                        ~~~~~~~~~~~~~~~~^~~~~
   drivers/scsi/ufs/ufshpb.c:78:23: note: Assuming field 'num_pinned' is 0
           hpb->lu_pinned_end = hpb_lu_info->num_pinned ?
                                ^~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:78:23: note: '?' condition is false
   drivers/scsi/ufs/ufshpb.c:84:2: note: Left side of '&&' is false
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:229:35: note: expanded from macro 'do_div'
           if (__builtin_constant_p(__base) &&             \
                                            ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: 4 is >= 4
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^~~~~~~~~~~~~~~~~~~~~
   arch/arm/include/asm/div64.h:64:32: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                  ^~~~~~~~
   note: expanded from here
   drivers/scsi/ufs/ufshpb.c:84:2: note: Left side of '&&' is true
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^
   arch/arm/include/asm/div64.h:64:31: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                 ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: Left side of '&&' is false
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:234:35: note: expanded from macro 'do_div'
                      __builtin_constant_p(__base) &&      \
                                                   ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: Assuming the condition is true
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:241:20: note: expanded from macro 'do_div'
           } else if (likely(((n) >> 32) == 0)) {          \
                      ~~~~~~~^~~~~~~~~~~~~~~~~
   include/linux/compiler.h:77:40: note: expanded from macro 'likely'
   # define likely(x)      __builtin_expect(!!(x), 1)
                                               ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: Taking true branch
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:241:9: note: expanded from macro 'do_div'
           } else if (likely(((n) >> 32) == 0)) {          \
                  ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Left side of '&&' is false
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:229:35: note: expanded from macro 'do_div'
           if (__builtin_constant_p(__base) &&             \
                                            ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: 4 is >= 4
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^~~~~~~~~~~~~~~~~~~~~
   arch/arm/include/asm/div64.h:64:32: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                  ^~~~~~~~
   note: expanded from here
   drivers/scsi/ufs/ufshpb.c:89:2: note: Left side of '&&' is true
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^
   arch/arm/include/asm/div64.h:64:31: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                 ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Left side of '&&' is false
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:234:35: note: expanded from macro 'do_div'
                      __builtin_constant_p(__base) &&      \
                                                   ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Assuming the condition is true
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:241:20: note: expanded from macro 'do_div'
           } else if (likely(((n) >> 32) == 0)) {          \
                      ~~~~~~~^~~~~~~~~~~~~~~~~
   include/linux/compiler.h:77:40: note: expanded from macro 'likely'
   # define likely(x)      __builtin_expect(!!(x), 1)
                                               ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Taking true branch
           do_div(tmp, HPB_ENTRY_SIZE);

vim +54 drivers/scsi/ufs/ufshpb.c

f02bc9754a6887 Daejun Park 2021-07-12   38  
f02bc9754a6887 Daejun Park 2021-07-12   39  static void ufshpb_init_subregion_tbl(struct ufshpb_lu *hpb,
f02bc9754a6887 Daejun Park 2021-07-12   40  				      struct ufshpb_region *rgn, bool last)
f02bc9754a6887 Daejun Park 2021-07-12   41  {
f02bc9754a6887 Daejun Park 2021-07-12   42  	int srgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   43  	struct ufshpb_subregion *srgn;
f02bc9754a6887 Daejun Park 2021-07-12   44  
f02bc9754a6887 Daejun Park 2021-07-12   45  	for (srgn_idx = 0; srgn_idx < rgn->srgn_cnt; srgn_idx++) {
f02bc9754a6887 Daejun Park 2021-07-12   46  		srgn = rgn->srgn_tbl + srgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   47  
f02bc9754a6887 Daejun Park 2021-07-12   48  		srgn->rgn_idx = rgn->rgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   49  		srgn->srgn_idx = srgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   50  		srgn->srgn_state = HPB_SRGN_UNUSED;
f02bc9754a6887 Daejun Park 2021-07-12   51  	}
f02bc9754a6887 Daejun Park 2021-07-12   52  
f02bc9754a6887 Daejun Park 2021-07-12   53  	if (unlikely(last && hpb->last_srgn_entries))
f02bc9754a6887 Daejun Park 2021-07-12  @54  		srgn->is_last = true;
f02bc9754a6887 Daejun Park 2021-07-12   55  }
f02bc9754a6887 Daejun Park 2021-07-12   56  
f02bc9754a6887 Daejun Park 2021-07-12   57  static int ufshpb_alloc_subregion_tbl(struct ufshpb_lu *hpb,
f02bc9754a6887 Daejun Park 2021-07-12   58  				      struct ufshpb_region *rgn, int srgn_cnt)
f02bc9754a6887 Daejun Park 2021-07-12   59  {
f02bc9754a6887 Daejun Park 2021-07-12   60  	rgn->srgn_tbl = kvcalloc(srgn_cnt, sizeof(struct ufshpb_subregion),
f02bc9754a6887 Daejun Park 2021-07-12   61  				 GFP_KERNEL);
f02bc9754a6887 Daejun Park 2021-07-12   62  	if (!rgn->srgn_tbl)
f02bc9754a6887 Daejun Park 2021-07-12   63  		return -ENOMEM;
f02bc9754a6887 Daejun Park 2021-07-12   64  
f02bc9754a6887 Daejun Park 2021-07-12   65  	rgn->srgn_cnt = srgn_cnt;
f02bc9754a6887 Daejun Park 2021-07-12   66  	return 0;
f02bc9754a6887 Daejun Park 2021-07-12   67  }
f02bc9754a6887 Daejun Park 2021-07-12   68  
f02bc9754a6887 Daejun Park 2021-07-12   69  static void ufshpb_lu_parameter_init(struct ufs_hba *hba,
f02bc9754a6887 Daejun Park 2021-07-12   70  				     struct ufshpb_lu *hpb,
f02bc9754a6887 Daejun Park 2021-07-12   71  				     struct ufshpb_dev_info *hpb_dev_info,
f02bc9754a6887 Daejun Park 2021-07-12   72  				     struct ufshpb_lu_info *hpb_lu_info)
f02bc9754a6887 Daejun Park 2021-07-12   73  {
f02bc9754a6887 Daejun Park 2021-07-12   74  	u32 entries_per_rgn;
f02bc9754a6887 Daejun Park 2021-07-12   75  	u64 rgn_mem_size, tmp;
f02bc9754a6887 Daejun Park 2021-07-12   76  
f02bc9754a6887 Daejun Park 2021-07-12   77  	hpb->lu_pinned_start = hpb_lu_info->pinned_start;
f02bc9754a6887 Daejun Park 2021-07-12   78  	hpb->lu_pinned_end = hpb_lu_info->num_pinned ?
f02bc9754a6887 Daejun Park 2021-07-12   79  		(hpb_lu_info->pinned_start + hpb_lu_info->num_pinned - 1)
f02bc9754a6887 Daejun Park 2021-07-12   80  		: PINNED_NOT_SET;
f02bc9754a6887 Daejun Park 2021-07-12   81  
f02bc9754a6887 Daejun Park 2021-07-12   82  	rgn_mem_size = (1ULL << hpb_dev_info->rgn_size) * HPB_RGN_SIZE_UNIT
f02bc9754a6887 Daejun Park 2021-07-12   83  			* HPB_ENTRY_SIZE;
f02bc9754a6887 Daejun Park 2021-07-12   84  	do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12   85  	hpb->srgn_mem_size = (1ULL << hpb_dev_info->srgn_size)
f02bc9754a6887 Daejun Park 2021-07-12   86  		* HPB_RGN_SIZE_UNIT / HPB_ENTRY_BLOCK_SIZE * HPB_ENTRY_SIZE;
f02bc9754a6887 Daejun Park 2021-07-12   87  
f02bc9754a6887 Daejun Park 2021-07-12   88  	tmp = rgn_mem_size;
f02bc9754a6887 Daejun Park 2021-07-12   89  	do_div(tmp, HPB_ENTRY_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12   90  	entries_per_rgn = (u32)tmp;
f02bc9754a6887 Daejun Park 2021-07-12   91  	hpb->entries_per_rgn_shift = ilog2(entries_per_rgn);
f02bc9754a6887 Daejun Park 2021-07-12   92  	hpb->entries_per_rgn_mask = entries_per_rgn - 1;
f02bc9754a6887 Daejun Park 2021-07-12   93  
f02bc9754a6887 Daejun Park 2021-07-12   94  	hpb->entries_per_srgn = hpb->srgn_mem_size / HPB_ENTRY_SIZE;
f02bc9754a6887 Daejun Park 2021-07-12   95  	hpb->entries_per_srgn_shift = ilog2(hpb->entries_per_srgn);
f02bc9754a6887 Daejun Park 2021-07-12   96  	hpb->entries_per_srgn_mask = hpb->entries_per_srgn - 1;
f02bc9754a6887 Daejun Park 2021-07-12   97  
f02bc9754a6887 Daejun Park 2021-07-12   98  	tmp = rgn_mem_size;
f02bc9754a6887 Daejun Park 2021-07-12   99  	do_div(tmp, hpb->srgn_mem_size);
f02bc9754a6887 Daejun Park 2021-07-12  100  	hpb->srgns_per_rgn = (int)tmp;
f02bc9754a6887 Daejun Park 2021-07-12  101  
f02bc9754a6887 Daejun Park 2021-07-12  102  	hpb->rgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
f02bc9754a6887 Daejun Park 2021-07-12  103  				entries_per_rgn);
f02bc9754a6887 Daejun Park 2021-07-12 @104  	hpb->srgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
f02bc9754a6887 Daejun Park 2021-07-12  105  				(hpb->srgn_mem_size / HPB_ENTRY_SIZE));
f02bc9754a6887 Daejun Park 2021-07-12  106  	hpb->last_srgn_entries = hpb_lu_info->num_blocks
f02bc9754a6887 Daejun Park 2021-07-12  107  				 % (hpb->srgn_mem_size / HPB_ENTRY_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12  108  
f02bc9754a6887 Daejun Park 2021-07-12  109  	hpb->pages_per_srgn = DIV_ROUND_UP(hpb->srgn_mem_size, PAGE_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12  110  }
f02bc9754a6887 Daejun Park 2021-07-12  111  

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp

^ permalink raw reply	[flat|nested] 5+ messages in thread

* drivers/scsi/ufs/ufshpb.c:54:17: warning: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn') [clang-analyzer-core.NullDereference]
@ 2021-11-27 16:52 kernel test robot
  0 siblings, 0 replies; 5+ messages in thread
From: kernel test robot @ 2021-11-27 16:52 UTC (permalink / raw)
  To: kbuild

[-- Attachment #1: Type: text/plain, Size: 23402 bytes --]

CC: llvm(a)lists.linux.dev
CC: kbuild-all(a)lists.01.org
CC: linux-kernel(a)vger.kernel.org
TO: Daejun Park <daejun7.park@samsung.com>
CC: "Martin K. Petersen" <martin.petersen@oracle.com>
CC: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>
CC: Bart Van Assche <bvanassche@acm.org>
CC: Can Guo <cang@codeaurora.org>
CC: Bean Huo <beanhuo@micron.com>
CC: Stanley Chu <stanley.chu@mediatek.com>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   c5c17547b778975b3d83a73c8d84e8fb5ecf3ba5
commit: f02bc9754a6887bf5e286889265d24ce5e3b1952 scsi: ufs: ufshpb: Introduce Host Performance Buffer feature
date:   4 months ago
:::::: branch date: 20 hours ago
:::::: commit date: 4 months ago
config: riscv-randconfig-c006-20211126 (https://download.01.org/0day-ci/archive/20211128/202111280002.PRuCKm9I-lkp(a)intel.com/config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 5162b558d8c0b542e752b037e72a69d5fd51eb1e)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # install riscv cross compiling tool for clang build
        # apt-get install binutils-riscv64-linux-gnu
        # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f02bc9754a6887bf5e286889265d24ce5e3b1952
        git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
        git fetch --no-tags linus master
        git checkout f02bc9754a6887bf5e286889265d24ce5e3b1952
        # save the config file to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=riscv clang-analyzer 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>


clang-analyzer warnings: (new ones prefixed by >>)
                   ^~~~~~~~~~~~~~~~~~
   kernel/torture.c:342:2: note: Loop condition is false. Execution continues on line 344
           for_each_online_cpu(cpu)
           ^
   include/linux/cpumask.h:789:36: note: expanded from macro 'for_each_online_cpu'
   #define for_each_online_cpu(cpu)   for_each_cpu((cpu), cpu_online_mask)
                                      ^
   include/linux/cpumask.h:241:2: note: expanded from macro 'for_each_cpu'
           for ((cpu) = -1;                                \
           ^
   kernel/torture.c:346:6: note: 'maxcpu' is not equal to 0
           if (maxcpu == 0) {
               ^~~~~~
   kernel/torture.c:346:2: note: Taking false branch
           if (maxcpu == 0) {
           ^
   kernel/torture.c:351:6: note: Assuming 'onoff_holdoff' is > 0
           if (onoff_holdoff > 0) {
               ^~~~~~~~~~~~~~~~~
   kernel/torture.c:351:2: note: Taking true branch
           if (onoff_holdoff > 0) {
           ^
   kernel/torture.c:352:3: note: Assuming 'verbose' is 0
                   VERBOSE_TOROUT_STRING("torture_onoff begin holdoff");
                   ^
   include/linux/torture.h:36:6: note: expanded from macro 'VERBOSE_TOROUT_STRING'
           if (verbose) {                                                          \
               ^~~~~~~
   kernel/torture.c:352:3: note: Taking false branch
                   VERBOSE_TOROUT_STRING("torture_onoff begin holdoff");
                   ^
   include/linux/torture.h:36:2: note: expanded from macro 'VERBOSE_TOROUT_STRING'
           if (verbose) {                                                          \
           ^
   kernel/torture.c:352:3: note: Loop condition is false.  Exiting loop
                   VERBOSE_TOROUT_STRING("torture_onoff begin holdoff");
                   ^
   include/linux/torture.h:34:34: note: expanded from macro 'VERBOSE_TOROUT_STRING'
   #define VERBOSE_TOROUT_STRING(s) \
                                    ^
   kernel/torture.c:354:3: note: Assuming 'verbose' is 0
                   VERBOSE_TOROUT_STRING("torture_onoff end holdoff");
                   ^
   include/linux/torture.h:36:6: note: expanded from macro 'VERBOSE_TOROUT_STRING'
           if (verbose) {                                                          \
               ^~~~~~~
   kernel/torture.c:354:3: note: Taking false branch
                   VERBOSE_TOROUT_STRING("torture_onoff end holdoff");
                   ^
   include/linux/torture.h:36:2: note: expanded from macro 'VERBOSE_TOROUT_STRING'
           if (verbose) {                                                          \
           ^
   kernel/torture.c:354:3: note: Loop condition is false.  Exiting loop
                   VERBOSE_TOROUT_STRING("torture_onoff end holdoff");
                   ^
   include/linux/torture.h:34:34: note: expanded from macro 'VERBOSE_TOROUT_STRING'
   #define VERBOSE_TOROUT_STRING(s) \
                                    ^
   kernel/torture.c:356:10: note: Calling 'torture_must_stop'
           while (!torture_must_stop()) {
                   ^~~~~~~~~~~~~~~~~~~
   kernel/torture.c:889:9: note: Left side of '||' is false
           return torture_must_stop_irq() || kthread_should_stop();
                  ^
   kernel/torture.c:889:36: note: Value assigned to 'disable_onoff_at_boot', which participates in a condition later
           return torture_must_stop_irq() || kthread_should_stop();
                                             ^~~~~~~~~~~~~~~~~~~~~
   kernel/torture.c:889:2: note: Returning value, which participates in a condition later
           return torture_must_stop_irq() || kthread_should_stop();
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   kernel/torture.c:356:10: note: Returning from 'torture_must_stop'
           while (!torture_must_stop()) {
                   ^~~~~~~~~~~~~~~~~~~
   kernel/torture.c:356:9: note: Assuming the condition is true
           while (!torture_must_stop()) {
                  ^~~~~~~~~~~~~~~~~~~~
   kernel/torture.c:356:2: note: Loop condition is true.  Entering loop body
           while (!torture_must_stop()) {
           ^
   kernel/torture.c:357:7: note: Assuming 'disable_onoff_at_boot' is false
                   if (disable_onoff_at_boot && !rcu_inkernel_boot_has_ended()) {
                       ^~~~~~~~~~~~~~~~~~~~~
   kernel/torture.c:357:29: note: Left side of '&&' is false
                   if (disable_onoff_at_boot && !rcu_inkernel_boot_has_ended()) {
                                             ^
   kernel/torture.c:361:38: note: Division by zero
                   cpu = (torture_random(&rand) >> 4) % (maxcpu + 1);
                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~
   Suppressed 6 warnings (6 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
   Suppressed 9 warnings (9 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   13 warnings generated.
>> drivers/scsi/ufs/ufshpb.c:54:17: warning: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn') [clang-analyzer-core.NullDereference]
                   srgn->is_last = true;
                                 ^
   drivers/scsi/ufs/ufshpb.c:475:6: note: Assuming 'lun' is < field 'max_lu_supported'
           if (lun >= hba->dev_info.max_lu_supported)
               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:475:2: note: Taking false branch
           if (lun >= hba->dev_info.max_lu_supported)
           ^
   drivers/scsi/ufs/ufshpb.c:479:6: note: 'ret' is 0
           if (ret)
               ^~~
   drivers/scsi/ufs/ufshpb.c:479:2: note: Taking false branch
           if (ret)
           ^
   drivers/scsi/ufs/ufshpb.c:482:8: note: Calling 'ufshpb_alloc_hpb_lu'
           hpb = ufshpb_alloc_hpb_lu(hba, lun, &hba->ufshpb_dev,
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:257:6: note: Assuming 'hpb' is non-null
           if (!hpb)
               ^~~~
   drivers/scsi/ufs/ufshpb.c:257:2: note: Taking false branch
           if (!hpb)
           ^
   drivers/scsi/ufs/ufshpb.c:264:8: note: Calling 'ufshpb_lu_hpb_init'
           ret = ufshpb_lu_hpb_init(hba, hpb);
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:241:8: note: Calling 'ufshpb_alloc_region_tbl'
           ret = ufshpb_alloc_region_tbl(hba, hpb);
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:120:6: note: Assuming 'rgn_table' is non-null
           if (!rgn_table)
               ^~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:120:2: note: Taking false branch
           if (!rgn_table)
           ^
   drivers/scsi/ufs/ufshpb.c:125:20: note: Assuming 'rgn_idx' is < field 'rgns_per_lu'
           for (rgn_idx = 0; rgn_idx < hpb->rgns_per_lu; rgn_idx++) {
                             ^~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:125:2: note: Loop condition is true.  Entering loop body
           for (rgn_idx = 0; rgn_idx < hpb->rgns_per_lu; rgn_idx++) {
           ^
   drivers/scsi/ufs/ufshpb.c:132:7: note: Assuming the condition is true
                   if (rgn_idx == hpb->rgns_per_lu - 1) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:132:3: note: Taking true branch
                   if (rgn_idx == hpb->rgns_per_lu - 1) {
                   ^
   drivers/scsi/ufs/ufshpb.c:139:7: note: 'ret' is 0
                   if (ret)
                       ^~~
   drivers/scsi/ufs/ufshpb.c:139:3: note: Taking false branch
                   if (ret)
                   ^
   drivers/scsi/ufs/ufshpb.c:141:3: note: Calling 'ufshpb_init_subregion_tbl'
                   ufshpb_init_subregion_tbl(hpb, rgn, last_srgn);
                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:43:2: note: 'srgn' declared without an initial value
           struct ufshpb_subregion *srgn;
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:45:21: note: Assuming 'srgn_idx' is >= field 'srgn_cnt'
           for (srgn_idx = 0; srgn_idx < rgn->srgn_cnt; srgn_idx++) {
                              ^~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:45:2: note: Loop condition is false. Execution continues on line 53
           for (srgn_idx = 0; srgn_idx < rgn->srgn_cnt; srgn_idx++) {
           ^
   drivers/scsi/ufs/ufshpb.c:53:15: note: 'last' is true
           if (unlikely(last && hpb->last_srgn_entries))
                        ^
   include/linux/compiler.h:78:42: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                               ^
   drivers/scsi/ufs/ufshpb.c:53:15: note: Left side of '&&' is true
           if (unlikely(last && hpb->last_srgn_entries))
                        ^
   drivers/scsi/ufs/ufshpb.c:53:6: note: Assuming the condition is false
           if (unlikely(last && hpb->last_srgn_entries))
               ^
   include/linux/compiler.h:78:40: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                             ^~~~
   drivers/scsi/ufs/ufshpb.c:53:2: note: Taking true branch
           if (unlikely(last && hpb->last_srgn_entries))
           ^
   drivers/scsi/ufs/ufshpb.c:54:17: note: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn')
                   srgn->is_last = true;
                   ~~~~          ^
>> drivers/scsi/ufs/ufshpb.c:104:22: warning: Division by zero [clang-analyzer-core.DivideZero]
           hpb->srgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
                               ^
   include/linux/math.h:36:22: note: expanded from macro 'DIV_ROUND_UP'
   #define DIV_ROUND_UP __KERNEL_DIV_ROUND_UP
                        ^
   include/uapi/linux/const.h:34:54: note: expanded from macro '__KERNEL_DIV_ROUND_UP'
   #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
                                        ~~~~~~~~~~~~~~~~^~~~~
   drivers/scsi/ufs/ufshpb.c:78:23: note: Assuming field 'num_pinned' is 0
           hpb->lu_pinned_end = hpb_lu_info->num_pinned ?
                                ^~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:78:23: note: '?' condition is false
   drivers/scsi/ufs/ufshpb.c:84:2: note: Left side of '&&' is false
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:229:35: note: expanded from macro 'do_div'
           if (__builtin_constant_p(__base) &&             \
                                            ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: 4 is >= 4
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^~~~~~~~~~~~~~~~~~~~~
   include/asm-generic/div64.h:68:32: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                  ^~~~~~~~
   note: expanded from here
   drivers/scsi/ufs/ufshpb.c:84:2: note: Left side of '&&' is true
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^
   include/asm-generic/div64.h:68:31: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                 ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: Left side of '&&' is false
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:234:35: note: expanded from macro 'do_div'
                      __builtin_constant_p(__base) &&      \
                                                   ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: Assuming the condition is false
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:241:20: note: expanded from macro 'do_div'
           } else if (likely(((n) >> 32) == 0)) {          \
                      ~~~~~~~^~~~~~~~~~~~~~~~~
   include/linux/compiler.h:77:40: note: expanded from macro 'likely'
   # define likely(x)      __builtin_expect(!!(x), 1)
                                               ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: Taking false branch
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:241:9: note: expanded from macro 'do_div'
           } else if (likely(((n) >> 32) == 0)) {          \
                  ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Left side of '&&' is false
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:229:35: note: expanded from macro 'do_div'
           if (__builtin_constant_p(__base) &&             \
                                            ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: 4 is >= 4
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^~~~~~~~~~~~~~~~~~~~~
   include/asm-generic/div64.h:68:32: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                  ^~~~~~~~
   note: expanded from here
   drivers/scsi/ufs/ufshpb.c:89:2: note: Left side of '&&' is true
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^
   include/asm-generic/div64.h:68:31: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                 ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Left side of '&&' is false
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:234:35: note: expanded from macro 'do_div'
                      __builtin_constant_p(__base) &&      \
                                                   ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Assuming the condition is false
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:241:20: note: expanded from macro 'do_div'
           } else if (likely(((n) >> 32) == 0)) {          \
                      ~~~~~~~^~~~~~~~~~~~~~~~~
   include/linux/compiler.h:77:40: note: expanded from macro 'likely'
   # define likely(x)      __builtin_expect(!!(x), 1)
                                               ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Taking false branch
           do_div(tmp, HPB_ENTRY_SIZE);

vim +54 drivers/scsi/ufs/ufshpb.c

f02bc9754a6887 Daejun Park 2021-07-12   38  
f02bc9754a6887 Daejun Park 2021-07-12   39  static void ufshpb_init_subregion_tbl(struct ufshpb_lu *hpb,
f02bc9754a6887 Daejun Park 2021-07-12   40  				      struct ufshpb_region *rgn, bool last)
f02bc9754a6887 Daejun Park 2021-07-12   41  {
f02bc9754a6887 Daejun Park 2021-07-12   42  	int srgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   43  	struct ufshpb_subregion *srgn;
f02bc9754a6887 Daejun Park 2021-07-12   44  
f02bc9754a6887 Daejun Park 2021-07-12   45  	for (srgn_idx = 0; srgn_idx < rgn->srgn_cnt; srgn_idx++) {
f02bc9754a6887 Daejun Park 2021-07-12   46  		srgn = rgn->srgn_tbl + srgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   47  
f02bc9754a6887 Daejun Park 2021-07-12   48  		srgn->rgn_idx = rgn->rgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   49  		srgn->srgn_idx = srgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   50  		srgn->srgn_state = HPB_SRGN_UNUSED;
f02bc9754a6887 Daejun Park 2021-07-12   51  	}
f02bc9754a6887 Daejun Park 2021-07-12   52  
f02bc9754a6887 Daejun Park 2021-07-12  @53  	if (unlikely(last && hpb->last_srgn_entries))
f02bc9754a6887 Daejun Park 2021-07-12  @54  		srgn->is_last = true;
f02bc9754a6887 Daejun Park 2021-07-12   55  }
f02bc9754a6887 Daejun Park 2021-07-12   56  
f02bc9754a6887 Daejun Park 2021-07-12   57  static int ufshpb_alloc_subregion_tbl(struct ufshpb_lu *hpb,
f02bc9754a6887 Daejun Park 2021-07-12   58  				      struct ufshpb_region *rgn, int srgn_cnt)
f02bc9754a6887 Daejun Park 2021-07-12   59  {
f02bc9754a6887 Daejun Park 2021-07-12   60  	rgn->srgn_tbl = kvcalloc(srgn_cnt, sizeof(struct ufshpb_subregion),
f02bc9754a6887 Daejun Park 2021-07-12   61  				 GFP_KERNEL);
f02bc9754a6887 Daejun Park 2021-07-12   62  	if (!rgn->srgn_tbl)
f02bc9754a6887 Daejun Park 2021-07-12   63  		return -ENOMEM;
f02bc9754a6887 Daejun Park 2021-07-12   64  
f02bc9754a6887 Daejun Park 2021-07-12   65  	rgn->srgn_cnt = srgn_cnt;
f02bc9754a6887 Daejun Park 2021-07-12   66  	return 0;
f02bc9754a6887 Daejun Park 2021-07-12   67  }
f02bc9754a6887 Daejun Park 2021-07-12   68  
f02bc9754a6887 Daejun Park 2021-07-12   69  static void ufshpb_lu_parameter_init(struct ufs_hba *hba,
f02bc9754a6887 Daejun Park 2021-07-12   70  				     struct ufshpb_lu *hpb,
f02bc9754a6887 Daejun Park 2021-07-12   71  				     struct ufshpb_dev_info *hpb_dev_info,
f02bc9754a6887 Daejun Park 2021-07-12   72  				     struct ufshpb_lu_info *hpb_lu_info)
f02bc9754a6887 Daejun Park 2021-07-12   73  {
f02bc9754a6887 Daejun Park 2021-07-12   74  	u32 entries_per_rgn;
f02bc9754a6887 Daejun Park 2021-07-12   75  	u64 rgn_mem_size, tmp;
f02bc9754a6887 Daejun Park 2021-07-12   76  
f02bc9754a6887 Daejun Park 2021-07-12   77  	hpb->lu_pinned_start = hpb_lu_info->pinned_start;
f02bc9754a6887 Daejun Park 2021-07-12   78  	hpb->lu_pinned_end = hpb_lu_info->num_pinned ?
f02bc9754a6887 Daejun Park 2021-07-12   79  		(hpb_lu_info->pinned_start + hpb_lu_info->num_pinned - 1)
f02bc9754a6887 Daejun Park 2021-07-12   80  		: PINNED_NOT_SET;
f02bc9754a6887 Daejun Park 2021-07-12   81  
f02bc9754a6887 Daejun Park 2021-07-12   82  	rgn_mem_size = (1ULL << hpb_dev_info->rgn_size) * HPB_RGN_SIZE_UNIT
f02bc9754a6887 Daejun Park 2021-07-12   83  			* HPB_ENTRY_SIZE;
f02bc9754a6887 Daejun Park 2021-07-12   84  	do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12   85  	hpb->srgn_mem_size = (1ULL << hpb_dev_info->srgn_size)
f02bc9754a6887 Daejun Park 2021-07-12   86  		* HPB_RGN_SIZE_UNIT / HPB_ENTRY_BLOCK_SIZE * HPB_ENTRY_SIZE;
f02bc9754a6887 Daejun Park 2021-07-12   87  
f02bc9754a6887 Daejun Park 2021-07-12   88  	tmp = rgn_mem_size;
f02bc9754a6887 Daejun Park 2021-07-12   89  	do_div(tmp, HPB_ENTRY_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12   90  	entries_per_rgn = (u32)tmp;
f02bc9754a6887 Daejun Park 2021-07-12   91  	hpb->entries_per_rgn_shift = ilog2(entries_per_rgn);
f02bc9754a6887 Daejun Park 2021-07-12   92  	hpb->entries_per_rgn_mask = entries_per_rgn - 1;
f02bc9754a6887 Daejun Park 2021-07-12   93  
f02bc9754a6887 Daejun Park 2021-07-12   94  	hpb->entries_per_srgn = hpb->srgn_mem_size / HPB_ENTRY_SIZE;
f02bc9754a6887 Daejun Park 2021-07-12   95  	hpb->entries_per_srgn_shift = ilog2(hpb->entries_per_srgn);
f02bc9754a6887 Daejun Park 2021-07-12   96  	hpb->entries_per_srgn_mask = hpb->entries_per_srgn - 1;
f02bc9754a6887 Daejun Park 2021-07-12   97  
f02bc9754a6887 Daejun Park 2021-07-12   98  	tmp = rgn_mem_size;
f02bc9754a6887 Daejun Park 2021-07-12   99  	do_div(tmp, hpb->srgn_mem_size);
f02bc9754a6887 Daejun Park 2021-07-12  100  	hpb->srgns_per_rgn = (int)tmp;
f02bc9754a6887 Daejun Park 2021-07-12  101  
f02bc9754a6887 Daejun Park 2021-07-12  102  	hpb->rgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
f02bc9754a6887 Daejun Park 2021-07-12  103  				entries_per_rgn);
f02bc9754a6887 Daejun Park 2021-07-12 @104  	hpb->srgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
f02bc9754a6887 Daejun Park 2021-07-12  105  				(hpb->srgn_mem_size / HPB_ENTRY_SIZE));
f02bc9754a6887 Daejun Park 2021-07-12  106  	hpb->last_srgn_entries = hpb_lu_info->num_blocks
f02bc9754a6887 Daejun Park 2021-07-12  107  				 % (hpb->srgn_mem_size / HPB_ENTRY_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12  108  
f02bc9754a6887 Daejun Park 2021-07-12  109  	hpb->pages_per_srgn = DIV_ROUND_UP(hpb->srgn_mem_size, PAGE_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12  110  }
f02bc9754a6887 Daejun Park 2021-07-12  111  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

^ permalink raw reply	[flat|nested] 5+ messages in thread

* drivers/scsi/ufs/ufshpb.c:54:17: warning: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn') [clang-analyzer-core.NullDereference]
@ 2021-09-05  9:20 kernel test robot
  0 siblings, 0 replies; 5+ messages in thread
From: kernel test robot @ 2021-09-05  9:20 UTC (permalink / raw)
  To: kbuild

[-- Attachment #1: Type: text/plain, Size: 23328 bytes --]

CC: llvm(a)lists.linux.dev
CC: kbuild-all(a)lists.01.org
CC: linux-kernel(a)vger.kernel.org
TO: Daejun Park <daejun7.park@samsung.com>
CC: "Martin K. Petersen" <martin.petersen@oracle.com>
CC: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>
CC: Bart Van Assche <bvanassche@acm.org>
CC: Can Guo <cang@codeaurora.org>
CC: Bean Huo <beanhuo@micron.com>
CC: Stanley Chu <stanley.chu@mediatek.com>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   49624efa65ac9889f4e7c7b2452b2e6ce42ba37d
commit: f02bc9754a6887bf5e286889265d24ce5e3b1952 scsi: ufs: ufshpb: Introduce Host Performance Buffer feature
date:   5 weeks ago
:::::: branch date: 15 hours ago
:::::: commit date: 5 weeks ago
config: riscv-randconfig-c006-20210904 (attached as .config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 1104e3258b5064e7110cc297e2cec60ac9acfc0a)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # install riscv cross compiling tool for clang build
        # apt-get install binutils-riscv64-linux-gnu
        # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f02bc9754a6887bf5e286889265d24ce5e3b1952
        git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
        git fetch --no-tags linus master
        git checkout f02bc9754a6887bf5e286889265d24ce5e3b1952
        # save the attached .config to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=riscv clang-analyzer 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>


clang-analyzer warnings: (new ones prefixed by >>)
   drivers/mtd/chips/cfi_cmdset_0001.c:1741:2: note: Loop condition is false.  Exiting loop
           ENABLE_VPP(map);
           ^
   include/linux/mtd/map.h:253:25: note: expanded from macro 'ENABLE_VPP'
   #define ENABLE_VPP(map) do { if (map->set_vpp) map->set_vpp(map, 1); } while (0)
                           ^
   drivers/mtd/chips/cfi_cmdset_0001.c:1748:6: note: Assuming field 'state' is equal to FL_STATUS
           if (chip->state != FL_STATUS) {
               ^~~~~~~~~~~~~~~~~~~~~~~~
   drivers/mtd/chips/cfi_cmdset_0001.c:1748:2: note: Taking false branch
           if (chip->state != FL_STATUS) {
           ^
   drivers/mtd/chips/cfi_cmdset_0001.c:1753:6: note: Loop condition is true.  Entering loop body
           if (map_word_bitsset(map, status, CMD(0x30))) {
               ^
   include/linux/mtd/map.h:312:2: note: expanded from macro 'map_word_bitsset'
           for (i = 0; i < map_words(map); i++) {                          \
           ^
   drivers/mtd/chips/cfi_cmdset_0001.c:1753:6: note: Assuming the condition is false
           if (map_word_bitsset(map, status, CMD(0x30))) {
               ^
   include/linux/mtd/map.h:313:7: note: expanded from macro 'map_word_bitsset'
                   if ((val1).x[i] & (val2).x[i]) {                        \
                       ^~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/mtd/chips/cfi_cmdset_0001.c:1753:6: note: Taking false branch
           if (map_word_bitsset(map, status, CMD(0x30))) {
               ^
   include/linux/mtd/map.h:313:3: note: expanded from macro 'map_word_bitsset'
                   if ((val1).x[i] & (val2).x[i]) {                        \
                   ^
   drivers/mtd/chips/cfi_cmdset_0001.c:1753:6: note: Loop condition is false. Execution continues on line 1753
           if (map_word_bitsset(map, status, CMD(0x30))) {
               ^
   include/linux/mtd/map.h:312:2: note: expanded from macro 'map_word_bitsset'
           for (i = 0; i < map_words(map); i++) {                          \
           ^
   drivers/mtd/chips/cfi_cmdset_0001.c:1753:2: note: Taking false branch
           if (map_word_bitsset(map, status, CMD(0x30))) {
           ^
   drivers/mtd/chips/cfi_cmdset_0001.c:1764:6: note: Assuming 'ret' is 0
           if (ret) {
               ^~~
   drivers/mtd/chips/cfi_cmdset_0001.c:1764:2: note: Taking false branch
           if (ret) {
           ^
   drivers/mtd/chips/cfi_cmdset_0001.c:1781:6: note: Assuming 'word_gap' is not equal to 0
           if (!word_gap) {
               ^~~~~~~~~
   drivers/mtd/chips/cfi_cmdset_0001.c:1781:2: note: Taking false branch
           if (!word_gap) {
           ^
   drivers/mtd/chips/cfi_cmdset_0001.c:1797:7: note: Assuming the condition is false
                   if (n > vec->iov_len - vec_seek)
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/mtd/chips/cfi_cmdset_0001.c:1797:3: note: Taking false branch
                   if (n > vec->iov_len - vec_seek)
                   ^
   drivers/mtd/chips/cfi_cmdset_0001.c:1799:7: note: Assuming 'n' is <= 'len'
                   if (n > len)
                       ^~~~~~~
   drivers/mtd/chips/cfi_cmdset_0001.c:1799:3: note: Taking false branch
                   if (n > len)
                   ^
   drivers/mtd/chips/cfi_cmdset_0001.c:1802:7: note: Assuming 'word_gap' is not equal to 0
                   if (!word_gap && len < map_bankwidth(map))
                       ^~~~~~~~~
   drivers/mtd/chips/cfi_cmdset_0001.c:1802:17: note: Left side of '&&' is false
                   if (!word_gap && len < map_bankwidth(map))
                                 ^
   drivers/mtd/chips/cfi_cmdset_0001.c:1811:7: note: Assuming 'len' is not equal to 0
                   if (!len || word_gap == map_bankwidth(map)) {
                       ^~~~
   drivers/mtd/chips/cfi_cmdset_0001.c:1811:7: note: Left side of '||' is false
   drivers/mtd/chips/cfi_cmdset_0001.c:1811:15: note: Assuming 'word_gap' is not equal to field 'bankwidth'
                   if (!len || word_gap == map_bankwidth(map)) {
                               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/mtd/chips/cfi_cmdset_0001.c:1811:3: note: Taking false branch
                   if (!len || word_gap == map_bankwidth(map)) {
                   ^
   drivers/mtd/chips/cfi_cmdset_0001.c:1818:7: note: Assuming 'vec_seek' is equal to field 'iov_len'
                   if (vec_seek == vec->iov_len) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~
   drivers/mtd/chips/cfi_cmdset_0001.c:1818:3: note: Taking true branch
                   if (vec_seek == vec->iov_len) {
                   ^
   drivers/mtd/chips/cfi_cmdset_0001.c:1795:2: note: Loop condition is true. Execution continues on line 1796
           do {
           ^
   drivers/mtd/chips/cfi_cmdset_0001.c:1797:24: note: The left operand of '-' is a garbage value
                   if (n > vec->iov_len - vec_seek)
                           ~~~~~~~~~~~~ ^
   Suppressed 4 warnings (4 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   5 warnings generated.
   Suppressed 5 warnings (5 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   5 warnings generated.
   Suppressed 5 warnings (5 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   9 warnings generated.
>> drivers/scsi/ufs/ufshpb.c:54:17: warning: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn') [clang-analyzer-core.NullDereference]
                   srgn->is_last = true;
                                 ^
   drivers/scsi/ufs/ufshpb.c:475:6: note: Assuming 'lun' is < field 'max_lu_supported'
           if (lun >= hba->dev_info.max_lu_supported)
               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:475:2: note: Taking false branch
           if (lun >= hba->dev_info.max_lu_supported)
           ^
   drivers/scsi/ufs/ufshpb.c:479:6: note: 'ret' is 0
           if (ret)
               ^~~
   drivers/scsi/ufs/ufshpb.c:479:2: note: Taking false branch
           if (ret)
           ^
   drivers/scsi/ufs/ufshpb.c:482:8: note: Calling 'ufshpb_alloc_hpb_lu'
           hpb = ufshpb_alloc_hpb_lu(hba, lun, &hba->ufshpb_dev,
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:257:6: note: Assuming 'hpb' is non-null
           if (!hpb)
               ^~~~
   drivers/scsi/ufs/ufshpb.c:257:2: note: Taking false branch
           if (!hpb)
           ^
   drivers/scsi/ufs/ufshpb.c:264:8: note: Calling 'ufshpb_lu_hpb_init'
           ret = ufshpb_lu_hpb_init(hba, hpb);
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:241:8: note: Calling 'ufshpb_alloc_region_tbl'
           ret = ufshpb_alloc_region_tbl(hba, hpb);
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:120:6: note: Assuming 'rgn_table' is non-null
           if (!rgn_table)
               ^~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:120:2: note: Taking false branch
           if (!rgn_table)
           ^
   drivers/scsi/ufs/ufshpb.c:125:20: note: Assuming 'rgn_idx' is < field 'rgns_per_lu'
           for (rgn_idx = 0; rgn_idx < hpb->rgns_per_lu; rgn_idx++) {
                             ^~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:125:2: note: Loop condition is true.  Entering loop body
           for (rgn_idx = 0; rgn_idx < hpb->rgns_per_lu; rgn_idx++) {
           ^
   drivers/scsi/ufs/ufshpb.c:132:7: note: Assuming the condition is true
                   if (rgn_idx == hpb->rgns_per_lu - 1) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:132:3: note: Taking true branch
                   if (rgn_idx == hpb->rgns_per_lu - 1) {
                   ^
   drivers/scsi/ufs/ufshpb.c:139:7: note: 'ret' is 0
                   if (ret)
                       ^~~
   drivers/scsi/ufs/ufshpb.c:139:3: note: Taking false branch
                   if (ret)
                   ^
   drivers/scsi/ufs/ufshpb.c:141:3: note: Calling 'ufshpb_init_subregion_tbl'
                   ufshpb_init_subregion_tbl(hpb, rgn, last_srgn);
                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:43:2: note: 'srgn' declared without an initial value
           struct ufshpb_subregion *srgn;
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:45:21: note: Assuming 'srgn_idx' is >= field 'srgn_cnt'
           for (srgn_idx = 0; srgn_idx < rgn->srgn_cnt; srgn_idx++) {
                              ^~~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:45:2: note: Loop condition is false. Execution continues on line 53
           for (srgn_idx = 0; srgn_idx < rgn->srgn_cnt; srgn_idx++) {
           ^
   drivers/scsi/ufs/ufshpb.c:53:15: note: 'last' is true
           if (unlikely(last && hpb->last_srgn_entries))
                        ^
   include/linux/compiler.h:78:42: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                               ^
   drivers/scsi/ufs/ufshpb.c:53:15: note: Left side of '&&' is true
           if (unlikely(last && hpb->last_srgn_entries))
                        ^
   drivers/scsi/ufs/ufshpb.c:53:6: note: Assuming the condition is false
           if (unlikely(last && hpb->last_srgn_entries))
               ^
   include/linux/compiler.h:78:40: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                             ^~~~
   drivers/scsi/ufs/ufshpb.c:53:2: note: Taking true branch
           if (unlikely(last && hpb->last_srgn_entries))
           ^
   drivers/scsi/ufs/ufshpb.c:54:17: note: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn')
                   srgn->is_last = true;
                   ~~~~          ^
>> drivers/scsi/ufs/ufshpb.c:104:22: warning: Division by zero [clang-analyzer-core.DivideZero]
           hpb->srgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
                               ^
   include/linux/math.h:36:22: note: expanded from macro 'DIV_ROUND_UP'
   #define DIV_ROUND_UP __KERNEL_DIV_ROUND_UP
                        ^
   include/uapi/linux/const.h:34:54: note: expanded from macro '__KERNEL_DIV_ROUND_UP'
   #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
                                        ~~~~~~~~~~~~~~~~^~~~~
   drivers/scsi/ufs/ufshpb.c:78:23: note: Assuming field 'num_pinned' is 0
           hpb->lu_pinned_end = hpb_lu_info->num_pinned ?
                                ^~~~~~~~~~~~~~~~~~~~~~~
   drivers/scsi/ufs/ufshpb.c:78:23: note: '?' condition is false
   drivers/scsi/ufs/ufshpb.c:84:2: note: Left side of '&&' is false
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:229:35: note: expanded from macro 'do_div'
           if (__builtin_constant_p(__base) &&             \
                                            ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: 4 is >= 4
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^~~~~~~~~~~~~~~~~~~~~
   include/asm-generic/div64.h:68:32: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                  ^~~~~~~~
   note: expanded from here
   drivers/scsi/ufs/ufshpb.c:84:2: note: Left side of '&&' is true
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^
   include/asm-generic/div64.h:68:31: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                 ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: Left side of '&&' is false
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:234:35: note: expanded from macro 'do_div'
                      __builtin_constant_p(__base) &&      \
                                                   ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: Assuming the condition is false
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:241:20: note: expanded from macro 'do_div'
           } else if (likely(((n) >> 32) == 0)) {          \
                      ~~~~~~~^~~~~~~~~~~~~~~~~
   include/linux/compiler.h:77:40: note: expanded from macro 'likely'
   # define likely(x)      __builtin_expect(!!(x), 1)
                                               ^
   drivers/scsi/ufs/ufshpb.c:84:2: note: Taking false branch
           do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
           ^
   include/asm-generic/div64.h:241:9: note: expanded from macro 'do_div'
           } else if (likely(((n) >> 32) == 0)) {          \
                  ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Left side of '&&' is false
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:229:35: note: expanded from macro 'do_div'
           if (__builtin_constant_p(__base) &&             \
                                            ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: 4 is >= 4
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^~~~~~~~~~~~~~~~~~~~~
   include/asm-generic/div64.h:68:32: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                  ^~~~~~~~
   note: expanded from here
   drivers/scsi/ufs/ufshpb.c:89:2: note: Left side of '&&' is true
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:233:13: note: expanded from macro 'do_div'
           } else if (__div64_const32_is_OK &&             \
                      ^
   include/asm-generic/div64.h:68:31: note: expanded from macro '__div64_const32_is_OK'
   #define __div64_const32_is_OK (__GNUC__ >= 4)
                                 ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Left side of '&&' is false
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:234:35: note: expanded from macro 'do_div'
                      __builtin_constant_p(__base) &&      \
                                                   ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Assuming the condition is false
           do_div(tmp, HPB_ENTRY_SIZE);
           ^
   include/asm-generic/div64.h:241:20: note: expanded from macro 'do_div'
           } else if (likely(((n) >> 32) == 0)) {          \
                      ~~~~~~~^~~~~~~~~~~~~~~~~
   include/linux/compiler.h:77:40: note: expanded from macro 'likely'
   # define likely(x)      __builtin_expect(!!(x), 1)
                                               ^
   drivers/scsi/ufs/ufshpb.c:89:2: note: Taking false branch
           do_div(tmp, HPB_ENTRY_SIZE);

vim +54 drivers/scsi/ufs/ufshpb.c

f02bc9754a6887 Daejun Park 2021-07-12   38  
f02bc9754a6887 Daejun Park 2021-07-12   39  static void ufshpb_init_subregion_tbl(struct ufshpb_lu *hpb,
f02bc9754a6887 Daejun Park 2021-07-12   40  				      struct ufshpb_region *rgn, bool last)
f02bc9754a6887 Daejun Park 2021-07-12   41  {
f02bc9754a6887 Daejun Park 2021-07-12   42  	int srgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   43  	struct ufshpb_subregion *srgn;
f02bc9754a6887 Daejun Park 2021-07-12   44  
f02bc9754a6887 Daejun Park 2021-07-12   45  	for (srgn_idx = 0; srgn_idx < rgn->srgn_cnt; srgn_idx++) {
f02bc9754a6887 Daejun Park 2021-07-12   46  		srgn = rgn->srgn_tbl + srgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   47  
f02bc9754a6887 Daejun Park 2021-07-12   48  		srgn->rgn_idx = rgn->rgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   49  		srgn->srgn_idx = srgn_idx;
f02bc9754a6887 Daejun Park 2021-07-12   50  		srgn->srgn_state = HPB_SRGN_UNUSED;
f02bc9754a6887 Daejun Park 2021-07-12   51  	}
f02bc9754a6887 Daejun Park 2021-07-12   52  
f02bc9754a6887 Daejun Park 2021-07-12  @53  	if (unlikely(last && hpb->last_srgn_entries))
f02bc9754a6887 Daejun Park 2021-07-12  @54  		srgn->is_last = true;
f02bc9754a6887 Daejun Park 2021-07-12   55  }
f02bc9754a6887 Daejun Park 2021-07-12   56  
f02bc9754a6887 Daejun Park 2021-07-12   57  static int ufshpb_alloc_subregion_tbl(struct ufshpb_lu *hpb,
f02bc9754a6887 Daejun Park 2021-07-12   58  				      struct ufshpb_region *rgn, int srgn_cnt)
f02bc9754a6887 Daejun Park 2021-07-12   59  {
f02bc9754a6887 Daejun Park 2021-07-12   60  	rgn->srgn_tbl = kvcalloc(srgn_cnt, sizeof(struct ufshpb_subregion),
f02bc9754a6887 Daejun Park 2021-07-12   61  				 GFP_KERNEL);
f02bc9754a6887 Daejun Park 2021-07-12   62  	if (!rgn->srgn_tbl)
f02bc9754a6887 Daejun Park 2021-07-12   63  		return -ENOMEM;
f02bc9754a6887 Daejun Park 2021-07-12   64  
f02bc9754a6887 Daejun Park 2021-07-12   65  	rgn->srgn_cnt = srgn_cnt;
f02bc9754a6887 Daejun Park 2021-07-12   66  	return 0;
f02bc9754a6887 Daejun Park 2021-07-12   67  }
f02bc9754a6887 Daejun Park 2021-07-12   68  
f02bc9754a6887 Daejun Park 2021-07-12   69  static void ufshpb_lu_parameter_init(struct ufs_hba *hba,
f02bc9754a6887 Daejun Park 2021-07-12   70  				     struct ufshpb_lu *hpb,
f02bc9754a6887 Daejun Park 2021-07-12   71  				     struct ufshpb_dev_info *hpb_dev_info,
f02bc9754a6887 Daejun Park 2021-07-12   72  				     struct ufshpb_lu_info *hpb_lu_info)
f02bc9754a6887 Daejun Park 2021-07-12   73  {
f02bc9754a6887 Daejun Park 2021-07-12   74  	u32 entries_per_rgn;
f02bc9754a6887 Daejun Park 2021-07-12   75  	u64 rgn_mem_size, tmp;
f02bc9754a6887 Daejun Park 2021-07-12   76  
f02bc9754a6887 Daejun Park 2021-07-12   77  	hpb->lu_pinned_start = hpb_lu_info->pinned_start;
f02bc9754a6887 Daejun Park 2021-07-12   78  	hpb->lu_pinned_end = hpb_lu_info->num_pinned ?
f02bc9754a6887 Daejun Park 2021-07-12   79  		(hpb_lu_info->pinned_start + hpb_lu_info->num_pinned - 1)
f02bc9754a6887 Daejun Park 2021-07-12   80  		: PINNED_NOT_SET;
f02bc9754a6887 Daejun Park 2021-07-12   81  
f02bc9754a6887 Daejun Park 2021-07-12   82  	rgn_mem_size = (1ULL << hpb_dev_info->rgn_size) * HPB_RGN_SIZE_UNIT
f02bc9754a6887 Daejun Park 2021-07-12   83  			* HPB_ENTRY_SIZE;
f02bc9754a6887 Daejun Park 2021-07-12   84  	do_div(rgn_mem_size, HPB_ENTRY_BLOCK_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12   85  	hpb->srgn_mem_size = (1ULL << hpb_dev_info->srgn_size)
f02bc9754a6887 Daejun Park 2021-07-12   86  		* HPB_RGN_SIZE_UNIT / HPB_ENTRY_BLOCK_SIZE * HPB_ENTRY_SIZE;
f02bc9754a6887 Daejun Park 2021-07-12   87  
f02bc9754a6887 Daejun Park 2021-07-12   88  	tmp = rgn_mem_size;
f02bc9754a6887 Daejun Park 2021-07-12   89  	do_div(tmp, HPB_ENTRY_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12   90  	entries_per_rgn = (u32)tmp;
f02bc9754a6887 Daejun Park 2021-07-12   91  	hpb->entries_per_rgn_shift = ilog2(entries_per_rgn);
f02bc9754a6887 Daejun Park 2021-07-12   92  	hpb->entries_per_rgn_mask = entries_per_rgn - 1;
f02bc9754a6887 Daejun Park 2021-07-12   93  
f02bc9754a6887 Daejun Park 2021-07-12   94  	hpb->entries_per_srgn = hpb->srgn_mem_size / HPB_ENTRY_SIZE;
f02bc9754a6887 Daejun Park 2021-07-12   95  	hpb->entries_per_srgn_shift = ilog2(hpb->entries_per_srgn);
f02bc9754a6887 Daejun Park 2021-07-12   96  	hpb->entries_per_srgn_mask = hpb->entries_per_srgn - 1;
f02bc9754a6887 Daejun Park 2021-07-12   97  
f02bc9754a6887 Daejun Park 2021-07-12   98  	tmp = rgn_mem_size;
f02bc9754a6887 Daejun Park 2021-07-12   99  	do_div(tmp, hpb->srgn_mem_size);
f02bc9754a6887 Daejun Park 2021-07-12  100  	hpb->srgns_per_rgn = (int)tmp;
f02bc9754a6887 Daejun Park 2021-07-12  101  
f02bc9754a6887 Daejun Park 2021-07-12  102  	hpb->rgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
f02bc9754a6887 Daejun Park 2021-07-12  103  				entries_per_rgn);
f02bc9754a6887 Daejun Park 2021-07-12 @104  	hpb->srgns_per_lu = DIV_ROUND_UP(hpb_lu_info->num_blocks,
f02bc9754a6887 Daejun Park 2021-07-12  105  				(hpb->srgn_mem_size / HPB_ENTRY_SIZE));
f02bc9754a6887 Daejun Park 2021-07-12  106  	hpb->last_srgn_entries = hpb_lu_info->num_blocks
f02bc9754a6887 Daejun Park 2021-07-12  107  				 % (hpb->srgn_mem_size / HPB_ENTRY_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12  108  
f02bc9754a6887 Daejun Park 2021-07-12  109  	hpb->pages_per_srgn = DIV_ROUND_UP(hpb->srgn_mem_size, PAGE_SIZE);
f02bc9754a6887 Daejun Park 2021-07-12  110  }
f02bc9754a6887 Daejun Park 2021-07-12  111  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 33169 bytes --]

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2022-05-08  5:44 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-22 22:33 drivers/scsi/ufs/ufshpb.c:54:17: warning: Access to field 'is_last' results in a dereference of an undefined pointer value (loaded from variable 'srgn') [clang-analyzer-core.NullDereference] kernel test robot
  -- strict thread matches above, loose matches on Subject: below --
2022-05-08  5:44 kernel test robot
2022-04-11  0:04 kernel test robot
2021-11-27 16:52 kernel test robot
2021-09-05  9:20 kernel test robot

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.