All of lore.kernel.org
 help / color / mirror / Atom feed
* include/linux/ceph/mdsmap.h:56:9: warning: Dereference of null pointer [clang-analyzer-core.NullDereference]
@ 2022-02-02 10:16 kernel test robot
  0 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2022-02-02 10:16 UTC (permalink / raw)
  To: kbuild

[-- Attachment #1: Type: text/plain, Size: 14282 bytes --]

CC: llvm(a)lists.linux.dev
CC: kbuild-all(a)lists.01.org
CC: linux-kernel(a)vger.kernel.org
TO: Xiubo Li <xiubli@redhat.com>
CC: Ilya Dryomov <idryomov@gmail.com>
CC: Jeff Layton <jlayton@kernel.org>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   9f7fb8de5d9bac17b6392a14af40baf555d9129b
commit: d517b3983dd3106ca92d6c5d0d09415a4a09481c ceph: reconnect to the export targets on new mdsmaps
date:   5 months ago
:::::: branch date: 13 hours ago
:::::: commit date: 5 months ago
config: riscv-randconfig-c006-20220129 (https://download.01.org/0day-ci/archive/20220202/202202021820.DpghlOur-lkp(a)intel.com/config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 33b45ee44b1f32ffdbc995e6fec806271b4b3ba4)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # install riscv cross compiling tool for clang build
        # apt-get install binutils-riscv64-linux-gnu
        # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d517b3983dd3106ca92d6c5d0d09415a4a09481c
        git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
        git fetch --no-tags linus master
        git checkout d517b3983dd3106ca92d6c5d0d09415a4a09481c
        # save the config file to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=riscv clang-analyzer 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>


clang-analyzer warnings: (new ones prefixed by >>)
           ^
   fs/ceph/mds_client.c:4934:8: note: 'session' is non-null
                   if (!session)
                        ^~~~~~~
   fs/ceph/mds_client.c:4934:3: note: Taking false branch
                   if (!session)
                   ^
   fs/ceph/mds_client.c:4937:7: note: Assuming field 's_state' is equal to CEPH_MDS_SESSION_REJECTED
                   if (session->s_state == CEPH_MDS_SESSION_REJECTED)
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4937:3: note: Taking true branch
                   if (session->s_state == CEPH_MDS_SESSION_REJECTED)
                   ^
   fs/ceph/mds_client.c:4938:4: note: Calling '__unregister_session'
                           __unregister_session(mdsc, session);
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:786:2: note: Taking false branch
           dout("__unregister_session mds%d %p\n", s->s_mds, s);
           ^
   include/linux/ceph/ceph_debug.h:25:3: note: expanded from macro 'dout'
                   if (0)                                          \
                   ^
   fs/ceph/mds_client.c:786:2: note: Loop condition is false.  Exiting loop
           dout("__unregister_session mds%d %p\n", s->s_mds, s);
           ^
   include/linux/ceph/ceph_debug.h:24:26: note: expanded from macro 'dout'
   #  define dout(fmt, ...)        do {                            \
                                   ^
   fs/ceph/mds_client.c:787:2: note: Assuming the condition is false
           BUG_ON(mdsc->sessions[s->s_mds] != s);
           ^
   include/asm-generic/bug.h:161:36: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                      ^~~~~~~~~~~~~~~~~~~
   include/linux/compiler.h:78:22: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:787:2: note: Taking false branch
           BUG_ON(mdsc->sessions[s->s_mds] != s);
           ^
   include/asm-generic/bug.h:161:32: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                  ^
   fs/ceph/mds_client.c:787:2: note: Loop condition is false.  Exiting loop
           BUG_ON(mdsc->sessions[s->s_mds] != s);
           ^
   include/asm-generic/bug.h:161:27: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                             ^
   fs/ceph/mds_client.c:790:2: note: Calling 'ceph_put_mds_session'
           ceph_put_mds_session(s);
           ^~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:668:2: note: Taking false branch
           if (IS_ERR_OR_NULL(s))
           ^
   fs/ceph/mds_client.c:671:2: note: Taking false branch
           dout("mdsc put_session %p %d -> %d\n", s,
           ^
   include/linux/ceph/ceph_debug.h:25:3: note: expanded from macro 'dout'
                   if (0)                                          \
                   ^
   fs/ceph/mds_client.c:671:2: note: Loop condition is false.  Exiting loop
           dout("mdsc put_session %p %d -> %d\n", s,
           ^
   include/linux/ceph/ceph_debug.h:24:26: note: expanded from macro 'dout'
   #  define dout(fmt, ...)        do {                            \
                                   ^
   fs/ceph/mds_client.c:673:2: note: Taking true branch
           if (refcount_dec_and_test(&s->s_ref)) {
           ^
   fs/ceph/mds_client.c:674:7: note: Assuming field 'authorizer' is null
                   if (s->s_auth.authorizer)
                       ^~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:674:3: note: Taking false branch
                   if (s->s_auth.authorizer)
                   ^
   fs/ceph/mds_client.c:676:3: note: Assuming the condition is false
                   WARN_ON(mutex_is_locked(&s->s_mutex));
                   ^
   include/asm-generic/bug.h:166:23: note: expanded from macro 'WARN_ON'
           int __ret_warn_on = !!(condition);                              \
                                ^~~~~~~~~~~~
   fs/ceph/mds_client.c:678:3: note: Memory is released
                   kfree(s);
                   ^~~~~~~~
   fs/ceph/mds_client.c:790:2: note: Returning; memory was released via 1st parameter
           ceph_put_mds_session(s);
           ^~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4938:4: note: Returning; memory was released via 2nd parameter
                           __unregister_session(mdsc, session);
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4943:3: note: Use of memory after it is freed
                   __close_session(mdsc, session);
                   ^                     ~~~~~~~
   fs/ceph/mds_client.c:5083:2: warning: Value stored to 'maplen' is never read [clang-analyzer-deadcode.DeadStores]
           maplen = ceph_decode_32(&p);
           ^        ~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:5083:2: note: Value stored to 'maplen' is never read
           maplen = ceph_decode_32(&p);
           ^        ~~~~~~~~~~~~~~~~~~
>> include/linux/ceph/mdsmap.h:56:9: warning: Dereference of null pointer [clang-analyzer-core.NullDereference]
           return m->m_info[w].state;
                  ^
   fs/ceph/mds_client.c:4180:2: note: Taking false branch
           dout("check_new_map new %u old %u\n",
           ^
   include/linux/ceph/ceph_debug.h:25:3: note: expanded from macro 'dout'
                   if (0)                                          \
                   ^
   fs/ceph/mds_client.c:4180:2: note: Loop condition is false.  Exiting loop
           dout("check_new_map new %u old %u\n",
           ^
   include/linux/ceph/ceph_debug.h:24:26: note: expanded from macro 'dout'
   #  define dout(fmt, ...)        do {                            \
                                   ^
   fs/ceph/mds_client.c:4183:6: note: Assuming field 'm_info' is null
           if (newmap->m_info) {
               ^~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4183:2: note: Taking false branch
           if (newmap->m_info) {
           ^
   fs/ceph/mds_client.c:4190:14: note: Assuming 'i' is >= field 'possible_max_rank'
           for (i = 0; i < oldmap->possible_max_rank && i < mdsc->max_sessions; i++) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4190:44: note: Left side of '&&' is false
           for (i = 0; i < oldmap->possible_max_rank && i < mdsc->max_sessions; i++) {
                                                     ^
   fs/ceph/mds_client.c:4269:14: note: Assuming 'i' is < field 'possible_max_rank'
           for (i = 0; i < newmap->possible_max_rank; i++) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4269:2: note: Loop condition is true.  Entering loop body
           for (i = 0; i < newmap->possible_max_rank; i++) {
           ^
   fs/ceph/mds_client.c:4282:14: note: Calling 'ceph_mdsmap_get_state'
                   newstate = ceph_mdsmap_get_state(newmap, i);
                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/ceph/mdsmap.h:53:2: note: Taking false branch
           BUG_ON(w < 0);
           ^
   include/asm-generic/bug.h:161:32: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                  ^
   include/linux/ceph/mdsmap.h:53:2: note: Loop condition is false.  Exiting loop
           BUG_ON(w < 0);
           ^
   include/asm-generic/bug.h:161:27: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                             ^
   include/linux/ceph/mdsmap.h:54:6: note: 'w' is < field 'possible_max_rank'
           if (w >= m->possible_max_rank)
               ^
   include/linux/ceph/mdsmap.h:54:2: note: Taking false branch
           if (w >= m->possible_max_rank)
           ^
   include/linux/ceph/mdsmap.h:56:9: note: Dereference of null pointer
           return m->m_info[w].state;
                  ^~~~~~~~~~~~~~~~~~
   Suppressed 4 warnings (4 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   3 warnings generated.
   Suppressed 3 warnings (3 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   4 warnings generated.
   Suppressed 4 warnings (4 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   3 warnings generated.
   Suppressed 3 warnings (3 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   4 warnings generated.
   Suppressed 4 warnings (4 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   3 warnings generated.
   Suppressed 3 warnings (3 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   3 warnings generated.
   Suppressed 3 warnings (3 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   3 warnings generated.
   Suppressed 3 warnings (3 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   3 warnings generated.
   Suppressed 3 warnings (3 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   3 warnings generated.
   Suppressed 3 warnings (3 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   3 warnings generated.
   Suppressed 3 warnings (3 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   4 warnings generated.
   lib/percpu_test.c:115:2: warning: Value stored to 'ul' is never read [clang-analyzer-deadcode.DeadStores]
           ul = 3;
           ^    ~
   lib/percpu_test.c:115:2: note: Value stored to 'ul' is never read
           ul = 3;
           ^    ~
   Suppressed 3 warnings (3 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   3 warnings generated.
   Suppressed 3 warnings (3 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.

vim +56 include/linux/ceph/mdsmap.h

2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  50  
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  51  static inline int ceph_mdsmap_get_state(struct ceph_mdsmap *m, int w)
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  52  {
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  53  	BUG_ON(w < 0);
b38c9eb4757d5b include/linux/ceph/mdsmap.h Xiubo Li  2019-12-04  54  	if (w >= m->possible_max_rank)
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  55  		return CEPH_MDS_STATE_DNE;
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06 @56  	return m->m_info[w].state;
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  57  }
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  58  

:::::: The code at line 56 was first introduced by commit
:::::: 2f2dc053404febedc9c273452d9d518fb31fde72 ceph: MDS client

:::::: TO: Sage Weil <sage@newdream.net>
:::::: CC: Sage Weil <sage@newdream.net>

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

^ permalink raw reply	[flat|nested] 4+ messages in thread

* include/linux/ceph/mdsmap.h:56:9: warning: Dereference of null pointer [clang-analyzer-core.NullDereference]
@ 2023-03-04 20:42 kernel test robot
  0 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2023-03-04 20:42 UTC (permalink / raw)
  To: oe-kbuild; +Cc: lkp

:::::: 
:::::: Manual check reason: "low confidence static check first_new_problem: include/linux/ceph/mdsmap.h:56:9: warning: Dereference of null pointer [clang-analyzer-core.NullDereference]"
:::::: 

BCC: lkp@intel.com
CC: llvm@lists.linux.dev
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Alexander Lobakin <alexandr.lobakin@intel.com>
CC: Yury Norov <yury.norov@gmail.com>
CC: Marco Elver <elver@google.com>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   0988a0ea791999ebbf95693f2676381825b05033
commit: b03fc1173c0c2bb8fad61902a862985cecdc4b1b bitops: let optimize out non-atomic bitops on compile-time constants
date:   8 months ago
:::::: branch date: 20 hours ago
:::::: commit date: 8 months ago
config: arm-randconfig-c002-20230302 (https://download.01.org/0day-ci/archive/20230305/202303050428.GG4qwbwY-lkp@intel.com/config)
compiler: clang version 17.0.0 (https://github.com/llvm/llvm-project 67409911353323ca5edf2049ef0df54132fa1ca7)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # install arm cross compiling tool for clang build
        # apt-get install binutils-arm-linux-gnueabi
        # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b03fc1173c0c2bb8fad61902a862985cecdc4b1b
        git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
        git fetch --no-tags linus master
        git checkout b03fc1173c0c2bb8fad61902a862985cecdc4b1b
        # save the config file
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm clang-analyzer  olddefconfig
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm clang-analyzer 

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@intel.com>
| Link: https://lore.kernel.org/r/202303050428.GG4qwbwY-lkp@intel.com/

clang_analyzer warnings: (new ones prefixed by >>)
           ^
   fs/ceph/mds_client.c:4920:16: note: Assuming 'mds' is < field 'max_sessions'
           for (mds = 0; mds < mdsc->max_sessions; mds++) {
                         ^~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4920:2: note: Loop condition is true.  Entering loop body
           for (mds = 0; mds < mdsc->max_sessions; mds++) {
           ^
   fs/ceph/mds_client.c:4922:8: note: 'session' is non-null
                   if (!session)
                        ^~~~~~~
   fs/ceph/mds_client.c:4922:3: note: Taking false branch
                   if (!session)
                   ^
   fs/ceph/mds_client.c:4925:7: note: Assuming field 's_state' is equal to CEPH_MDS_SESSION_REJECTED
                   if (session->s_state == CEPH_MDS_SESSION_REJECTED)
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4925:3: note: Taking true branch
                   if (session->s_state == CEPH_MDS_SESSION_REJECTED)
                   ^
   fs/ceph/mds_client.c:4926:4: note: Calling '__unregister_session'
                           __unregister_session(mdsc, session);
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:803:2: note: Taking false branch
           dout("__unregister_session mds%d %p\n", s->s_mds, s);
           ^
   include/linux/ceph/ceph_debug.h:35:25: note: expanded from macro 'dout'
   # define dout(fmt, ...) pr_debug(" " fmt, ##__VA_ARGS__)
                           ^
   include/linux/printk.h:610:2: note: expanded from macro 'pr_debug'
           no_printk(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
           ^
   include/linux/printk.h:130:2: note: expanded from macro 'no_printk'
           if (0)                                          \
           ^
   fs/ceph/mds_client.c:804:2: note: Assuming the condition is false
           BUG_ON(mdsc->sessions[s->s_mds] != s);
           ^
   include/asm-generic/bug.h:71:36: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                      ^~~~~~~~~~~~~~~~~~~
   include/linux/compiler.h:78:22: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:804:2: note: Taking false branch
           BUG_ON(mdsc->sessions[s->s_mds] != s);
           ^
   include/asm-generic/bug.h:71:32: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                  ^
   fs/ceph/mds_client.c:804:2: note: Loop condition is false.  Exiting loop
           BUG_ON(mdsc->sessions[s->s_mds] != s);
           ^
   include/asm-generic/bug.h:71:27: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                             ^
   fs/ceph/mds_client.c:807:2: note: Calling 'ceph_put_mds_session'
           ceph_put_mds_session(s);
           ^~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:687:2: note: Taking false branch
           if (IS_ERR_OR_NULL(s))
           ^
   fs/ceph/mds_client.c:690:2: note: Taking true branch
           if (refcount_dec_and_test(&s->s_ref)) {
           ^
   fs/ceph/mds_client.c:691:7: note: Assuming field 'authorizer' is null
                   if (s->s_auth.authorizer)
                       ^~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:691:3: note: Taking false branch
                   if (s->s_auth.authorizer)
                   ^
   fs/ceph/mds_client.c:693:3: note: Assuming the condition is true
                   WARN_ON(mutex_is_locked(&s->s_mutex));
                   ^
   include/asm-generic/bug.h:122:23: note: expanded from macro 'WARN_ON'
           int __ret_warn_on = !!(condition);                              \
                                ^~~~~~~~~~~~
   fs/ceph/mds_client.c:693:3: note: Taking false branch
                   WARN_ON(mutex_is_locked(&s->s_mutex));
                   ^
   include/asm-generic/bug.h:123:2: note: expanded from macro 'WARN_ON'
           if (unlikely(__ret_warn_on))                                    \
           ^
   fs/ceph/mds_client.c:695:3: note: Memory is released
                   kfree(s);
                   ^~~~~~~~
   fs/ceph/mds_client.c:807:2: note: Returning; memory was released via 1st parameter
           ceph_put_mds_session(s);
           ^~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4926:4: note: Returning; memory was released via 2nd parameter
                           __unregister_session(mdsc, session);
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4931:3: note: Use of memory after it is freed
                   __close_session(mdsc, session);
                   ^                     ~~~~~~~
   fs/ceph/mds_client.c:5072:2: warning: Value stored to 'maplen' is never read [clang-analyzer-deadcode.DeadStores]
           maplen = ceph_decode_32(&p);
           ^        ~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:5072:2: note: Value stored to 'maplen' is never read
           maplen = ceph_decode_32(&p);
           ^        ~~~~~~~~~~~~~~~~~~
>> include/linux/ceph/mdsmap.h:56:9: warning: Dereference of null pointer [clang-analyzer-core.NullDereference]
           return m->m_info[w].state;
                  ^
   fs/ceph/mds_client.c:4156:2: note: Taking false branch
           dout("check_new_map new %u old %u\n",
           ^
   include/linux/ceph/ceph_debug.h:35:25: note: expanded from macro 'dout'
   # define dout(fmt, ...) pr_debug(" " fmt, ##__VA_ARGS__)
                           ^
   include/linux/printk.h:610:2: note: expanded from macro 'pr_debug'
           no_printk(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
           ^
   include/linux/printk.h:130:2: note: expanded from macro 'no_printk'
           if (0)                                          \
           ^
   fs/ceph/mds_client.c:4159:6: note: Assuming field 'm_info' is null
           if (newmap->m_info) {
               ^~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4159:2: note: Taking false branch
           if (newmap->m_info) {
           ^
   fs/ceph/mds_client.c:4166:14: note: Assuming 'i' is >= field 'possible_max_rank'
           for (i = 0; i < oldmap->possible_max_rank && i < mdsc->max_sessions; i++) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4166:44: note: Left side of '&&' is false
           for (i = 0; i < oldmap->possible_max_rank && i < mdsc->max_sessions; i++) {
                                                     ^
   fs/ceph/mds_client.c:4245:14: note: Assuming 'i' is < field 'possible_max_rank'
           for (i = 0; i < newmap->possible_max_rank; i++) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4245:2: note: Loop condition is true.  Entering loop body
           for (i = 0; i < newmap->possible_max_rank; i++) {
           ^
   fs/ceph/mds_client.c:4258:14: note: Calling 'ceph_mdsmap_get_state'
                   newstate = ceph_mdsmap_get_state(newmap, i);
                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/ceph/mdsmap.h:53:2: note: Taking false branch
           BUG_ON(w < 0);
           ^
   include/asm-generic/bug.h:71:32: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                  ^
   include/linux/ceph/mdsmap.h:53:2: note: Loop condition is false.  Exiting loop
           BUG_ON(w < 0);
           ^
   include/asm-generic/bug.h:71:27: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                             ^
   include/linux/ceph/mdsmap.h:54:6: note: 'w' is < field 'possible_max_rank'
           if (w >= m->possible_max_rank)
               ^
   include/linux/ceph/mdsmap.h:54:2: note: Taking false branch
           if (w >= m->possible_max_rank)
           ^
   include/linux/ceph/mdsmap.h:56:9: note: Dereference of null pointer
           return m->m_info[w].state;
                  ^~~~~~~~~~~~~~~~~~
   Suppressed 63 warnings (63 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   43 warnings generated.
   drivers/hwmon/shtc1.c:146:9: warning: Call to function 'sprintf' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
           return sprintf(buf, "%d\n", data->temperature);
                  ^~~~~~~
   drivers/hwmon/shtc1.c:146:9: note: Call to function 'sprintf' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11
           return sprintf(buf, "%d\n", data->temperature);
                  ^~~~~~~
   drivers/hwmon/shtc1.c:156:9: warning: Call to function 'sprintf' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
           return sprintf(buf, "%d\n", data->humidity);
                  ^~~~~~~
   drivers/hwmon/shtc1.c:156:9: note: Call to function 'sprintf' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11
           return sprintf(buf, "%d\n", data->humidity);
                  ^~~~~~~
   Suppressed 41 warnings (41 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   16 warnings generated.
   drivers/hwmon/smsc47b397.c:164:9: warning: Call to function 'sprintf' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
           return sprintf(buf, "%d\n", temp_from_reg(data->temp[attr->index]));
                  ^~~~~~~
   drivers/hwmon/smsc47b397.c:164:9: note: Call to function 'sprintf' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11
           return sprintf(buf, "%d\n", temp_from_reg(data->temp[attr->index]));
                  ^~~~~~~
   drivers/hwmon/smsc47b397.c:188:9: warning: Call to function 'sprintf' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
           return sprintf(buf, "%d\n", fan_from_reg(data->fan[attr->index]));
                  ^~~~~~~
   drivers/hwmon/smsc47b397.c:188:9: note: Call to function 'sprintf' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11
           return sprintf(buf, "%d\n", fan_from_reg(data->fan[attr->index]));
                  ^~~~~~~
   Suppressed 14 warnings (14 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   22 warnings generated.
   drivers/hwmon/smsc47m1.c:213:9: warning: Call to function 'sprintf' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
           return sprintf(buf, "%d\n", rpm);
                  ^~~~~~~
   drivers/hwmon/smsc47m1.c:213:9: note: Call to function 'sprintf' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11
           return sprintf(buf, "%d\n", rpm);
                  ^~~~~~~
   drivers/hwmon/smsc47m1.c:224:9: warning: Call to function 'sprintf' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
           return sprintf(buf, "%d\n", rpm);
                  ^~~~~~~
   drivers/hwmon/smsc47m1.c:224:9: note: Call to function 'sprintf' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'sprintf_s' in case of C11
           return sprintf(buf, "%d\n", rpm);

vim +56 include/linux/ceph/mdsmap.h

2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  50  
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  51  static inline int ceph_mdsmap_get_state(struct ceph_mdsmap *m, int w)
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  52  {
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  53  	BUG_ON(w < 0);
b38c9eb4757d5b include/linux/ceph/mdsmap.h Xiubo Li  2019-12-04  54  	if (w >= m->possible_max_rank)
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  55  		return CEPH_MDS_STATE_DNE;
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06 @56  	return m->m_info[w].state;
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  57  }
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  58  

:::::: The code at line 56 was first introduced by commit
:::::: 2f2dc053404febedc9c273452d9d518fb31fde72 ceph: MDS client

:::::: TO: Sage Weil <sage@newdream.net>
:::::: CC: Sage Weil <sage@newdream.net>

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests

^ permalink raw reply	[flat|nested] 4+ messages in thread

* include/linux/ceph/mdsmap.h:56:9: warning: Dereference of null pointer [clang-analyzer-core.NullDereference]
@ 2022-01-30  1:10 kernel test robot
  0 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2022-01-30  1:10 UTC (permalink / raw)
  To: kbuild

[-- Attachment #1: Type: text/plain, Size: 14549 bytes --]

CC: llvm(a)lists.linux.dev
CC: kbuild-all(a)lists.01.org
CC: linux-kernel(a)vger.kernel.org
TO: Xiubo Li <xiubli@redhat.com>
CC: Ilya Dryomov <idryomov@gmail.com>
CC: Jeff Layton <jlayton@kernel.org>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   f8c7e4ede46fe63ff10000669652648aab09d112
commit: d517b3983dd3106ca92d6c5d0d09415a4a09481c ceph: reconnect to the export targets on new mdsmaps
date:   5 months ago
:::::: branch date: 8 hours ago
:::::: commit date: 5 months ago
config: riscv-randconfig-c006-20220129 (https://download.01.org/0day-ci/archive/20220130/202201300935.qD3VEO2M-lkp(a)intel.com/config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 33b45ee44b1f32ffdbc995e6fec806271b4b3ba4)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # install riscv cross compiling tool for clang build
        # apt-get install binutils-riscv64-linux-gnu
        # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d517b3983dd3106ca92d6c5d0d09415a4a09481c
        git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
        git fetch --no-tags linus master
        git checkout d517b3983dd3106ca92d6c5d0d09415a4a09481c
        # save the config file to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=riscv clang-analyzer 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>


clang-analyzer warnings: (new ones prefixed by >>)
           ^
   fs/ceph/mds_client.c:4934:8: note: 'session' is non-null
                   if (!session)
                        ^~~~~~~
   fs/ceph/mds_client.c:4934:3: note: Taking false branch
                   if (!session)
                   ^
   fs/ceph/mds_client.c:4937:7: note: Assuming field 's_state' is equal to CEPH_MDS_SESSION_REJECTED
                   if (session->s_state == CEPH_MDS_SESSION_REJECTED)
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4937:3: note: Taking true branch
                   if (session->s_state == CEPH_MDS_SESSION_REJECTED)
                   ^
   fs/ceph/mds_client.c:4938:4: note: Calling '__unregister_session'
                           __unregister_session(mdsc, session);
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:786:2: note: Taking false branch
           dout("__unregister_session mds%d %p\n", s->s_mds, s);
           ^
   include/linux/ceph/ceph_debug.h:25:3: note: expanded from macro 'dout'
                   if (0)                                          \
                   ^
   fs/ceph/mds_client.c:786:2: note: Loop condition is false.  Exiting loop
           dout("__unregister_session mds%d %p\n", s->s_mds, s);
           ^
   include/linux/ceph/ceph_debug.h:24:26: note: expanded from macro 'dout'
   #  define dout(fmt, ...)        do {                            \
                                   ^
   fs/ceph/mds_client.c:787:2: note: Assuming the condition is false
           BUG_ON(mdsc->sessions[s->s_mds] != s);
           ^
   include/asm-generic/bug.h:161:36: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                      ^~~~~~~~~~~~~~~~~~~
   include/linux/compiler.h:78:22: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:787:2: note: Taking false branch
           BUG_ON(mdsc->sessions[s->s_mds] != s);
           ^
   include/asm-generic/bug.h:161:32: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                  ^
   fs/ceph/mds_client.c:787:2: note: Loop condition is false.  Exiting loop
           BUG_ON(mdsc->sessions[s->s_mds] != s);
           ^
   include/asm-generic/bug.h:161:27: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                             ^
   fs/ceph/mds_client.c:790:2: note: Calling 'ceph_put_mds_session'
           ceph_put_mds_session(s);
           ^~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:668:2: note: Taking false branch
           if (IS_ERR_OR_NULL(s))
           ^
   fs/ceph/mds_client.c:671:2: note: Taking false branch
           dout("mdsc put_session %p %d -> %d\n", s,
           ^
   include/linux/ceph/ceph_debug.h:25:3: note: expanded from macro 'dout'
                   if (0)                                          \
                   ^
   fs/ceph/mds_client.c:671:2: note: Loop condition is false.  Exiting loop
           dout("mdsc put_session %p %d -> %d\n", s,
           ^
   include/linux/ceph/ceph_debug.h:24:26: note: expanded from macro 'dout'
   #  define dout(fmt, ...)        do {                            \
                                   ^
   fs/ceph/mds_client.c:673:2: note: Taking true branch
           if (refcount_dec_and_test(&s->s_ref)) {
           ^
   fs/ceph/mds_client.c:674:7: note: Assuming field 'authorizer' is null
                   if (s->s_auth.authorizer)
                       ^~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:674:3: note: Taking false branch
                   if (s->s_auth.authorizer)
                   ^
   fs/ceph/mds_client.c:676:3: note: Assuming the condition is false
                   WARN_ON(mutex_is_locked(&s->s_mutex));
                   ^
   include/asm-generic/bug.h:166:23: note: expanded from macro 'WARN_ON'
           int __ret_warn_on = !!(condition);                              \
                                ^~~~~~~~~~~~
   fs/ceph/mds_client.c:678:3: note: Memory is released
                   kfree(s);
                   ^~~~~~~~
   fs/ceph/mds_client.c:790:2: note: Returning; memory was released via 1st parameter
           ceph_put_mds_session(s);
           ^~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4938:4: note: Returning; memory was released via 2nd parameter
                           __unregister_session(mdsc, session);
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4943:3: note: Use of memory after it is freed
                   __close_session(mdsc, session);
                   ^                     ~~~~~~~
   fs/ceph/mds_client.c:5083:2: warning: Value stored to 'maplen' is never read [clang-analyzer-deadcode.DeadStores]
           maplen = ceph_decode_32(&p);
           ^        ~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:5083:2: note: Value stored to 'maplen' is never read
           maplen = ceph_decode_32(&p);
           ^        ~~~~~~~~~~~~~~~~~~
>> include/linux/ceph/mdsmap.h:56:9: warning: Dereference of null pointer [clang-analyzer-core.NullDereference]
           return m->m_info[w].state;
                  ^
   fs/ceph/mds_client.c:4180:2: note: Taking false branch
           dout("check_new_map new %u old %u\n",
           ^
   include/linux/ceph/ceph_debug.h:25:3: note: expanded from macro 'dout'
                   if (0)                                          \
                   ^
   fs/ceph/mds_client.c:4180:2: note: Loop condition is false.  Exiting loop
           dout("check_new_map new %u old %u\n",
           ^
   include/linux/ceph/ceph_debug.h:24:26: note: expanded from macro 'dout'
   #  define dout(fmt, ...)        do {                            \
                                   ^
   fs/ceph/mds_client.c:4183:6: note: Assuming field 'm_info' is null
           if (newmap->m_info) {
               ^~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4183:2: note: Taking false branch
           if (newmap->m_info) {
           ^
   fs/ceph/mds_client.c:4190:14: note: Assuming 'i' is >= field 'possible_max_rank'
           for (i = 0; i < oldmap->possible_max_rank && i < mdsc->max_sessions; i++) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4190:44: note: Left side of '&&' is false
           for (i = 0; i < oldmap->possible_max_rank && i < mdsc->max_sessions; i++) {
                                                     ^
   fs/ceph/mds_client.c:4269:14: note: Assuming 'i' is < field 'possible_max_rank'
           for (i = 0; i < newmap->possible_max_rank; i++) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4269:2: note: Loop condition is true.  Entering loop body
           for (i = 0; i < newmap->possible_max_rank; i++) {
           ^
   fs/ceph/mds_client.c:4282:14: note: Calling 'ceph_mdsmap_get_state'
                   newstate = ceph_mdsmap_get_state(newmap, i);
                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/ceph/mdsmap.h:53:2: note: Taking false branch
           BUG_ON(w < 0);
           ^
   include/asm-generic/bug.h:161:32: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                  ^
   include/linux/ceph/mdsmap.h:53:2: note: Loop condition is false.  Exiting loop
           BUG_ON(w < 0);
           ^
   include/asm-generic/bug.h:161:27: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                             ^
   include/linux/ceph/mdsmap.h:54:6: note: 'w' is < field 'possible_max_rank'
           if (w >= m->possible_max_rank)
               ^
   include/linux/ceph/mdsmap.h:54:2: note: Taking false branch
           if (w >= m->possible_max_rank)
           ^
   include/linux/ceph/mdsmap.h:56:9: note: Dereference of null pointer
           return m->m_info[w].state;
                  ^~~~~~~~~~~~~~~~~~
   Suppressed 4 warnings (4 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   2 warnings generated.
   Suppressed 2 warnings (2 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   3 warnings generated.
   Suppressed 3 warnings (3 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   5 warnings generated.
   drivers/video/backlight/88pm860x_bl.c:130:22: warning: Value stored to 'chip' during its initialization is never read [clang-analyzer-deadcode.DeadStores]
           struct pm860x_chip *chip = data->chip;
                               ^~~~   ~~~~~~~~~~
   drivers/video/backlight/88pm860x_bl.c:130:22: note: Value stored to 'chip' during its initialization is never read
           struct pm860x_chip *chip = data->chip;
                               ^~~~   ~~~~~~~~~~
   Suppressed 4 warnings (4 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   4 warnings generated.
   Suppressed 4 warnings (4 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   4 warnings generated.
   Suppressed 4 warnings (4 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   4 warnings generated.
   Suppressed 4 warnings (4 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   4 warnings generated.
   Suppressed 4 warnings (4 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   5 warnings generated.
   drivers/video/backlight/qcom-wled.c:1124:3: warning: Value stored to 'rc' is never read [clang-analyzer-deadcode.DeadStores]
                   rc = regmap_update_bits(wled->regmap, addr,
                   ^    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   drivers/video/backlight/qcom-wled.c:1124:3: note: Value stored to 'rc' is never read
                   rc = regmap_update_bits(wled->regmap, addr,
                   ^    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   Suppressed 4 warnings (4 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   4 warnings generated.
   Suppressed 4 warnings (4 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   2 warnings generated.
   Suppressed 2 warnings (2 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.

vim +56 include/linux/ceph/mdsmap.h

2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  50  
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  51  static inline int ceph_mdsmap_get_state(struct ceph_mdsmap *m, int w)
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  52  {
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  53  	BUG_ON(w < 0);
b38c9eb4757d5b include/linux/ceph/mdsmap.h Xiubo Li  2019-12-04  54  	if (w >= m->possible_max_rank)
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  55  		return CEPH_MDS_STATE_DNE;
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06 @56  	return m->m_info[w].state;
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  57  }
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  58  

:::::: The code at line 56 was first introduced by commit
:::::: 2f2dc053404febedc9c273452d9d518fb31fde72 ceph: MDS client

:::::: TO: Sage Weil <sage@newdream.net>
:::::: CC: Sage Weil <sage@newdream.net>

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

^ permalink raw reply	[flat|nested] 4+ messages in thread

* include/linux/ceph/mdsmap.h:56:9: warning: Dereference of null pointer [clang-analyzer-core.NullDereference]
@ 2021-12-19 16:02 kernel test robot
  0 siblings, 0 replies; 4+ messages in thread
From: kernel test robot @ 2021-12-19 16:02 UTC (permalink / raw)
  To: kbuild

[-- Attachment #1: Type: text/plain, Size: 14446 bytes --]

CC: llvm(a)lists.linux.dev
CC: kbuild-all(a)lists.01.org
CC: linux-kernel(a)vger.kernel.org
TO: Xiubo Li <xiubli@redhat.com>
CC: Ilya Dryomov <idryomov@gmail.com>
CC: Jeff Layton <jlayton@kernel.org>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   3f667b5d4053ad54aee13dab5c94f04ff75ddfdf
commit: d517b3983dd3106ca92d6c5d0d09415a4a09481c ceph: reconnect to the export targets on new mdsmaps
date:   4 months ago
:::::: branch date: 19 hours ago
:::::: commit date: 4 months ago
config: arm-randconfig-c002-20211211 (https://download.01.org/0day-ci/archive/20211219/202112192306.cbGnWUEP-lkp(a)intel.com/config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 097a1cb1d5ebb3a0ec4bcaed8ba3ff6a8e33c00a)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # install arm cross compiling tool for clang build
        # apt-get install binutils-arm-linux-gnueabi
        # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d517b3983dd3106ca92d6c5d0d09415a4a09481c
        git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
        git fetch --no-tags linus master
        git checkout d517b3983dd3106ca92d6c5d0d09415a4a09481c
        # save the config file to linux build tree
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm clang-analyzer 

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>


clang-analyzer warnings: (new ones prefixed by >>)
           ^
   fs/ceph/mds_client.c:4934:8: note: 'session' is non-null
                   if (!session)
                        ^~~~~~~
   fs/ceph/mds_client.c:4934:3: note: Taking false branch
                   if (!session)
                   ^
   fs/ceph/mds_client.c:4937:7: note: Assuming field 's_state' is equal to CEPH_MDS_SESSION_REJECTED
                   if (session->s_state == CEPH_MDS_SESSION_REJECTED)
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4937:3: note: Taking true branch
                   if (session->s_state == CEPH_MDS_SESSION_REJECTED)
                   ^
   fs/ceph/mds_client.c:4938:4: note: Calling '__unregister_session'
                           __unregister_session(mdsc, session);
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:786:2: note: Taking false branch
           dout("__unregister_session mds%d %p\n", s->s_mds, s);
           ^
   include/linux/ceph/ceph_debug.h:25:3: note: expanded from macro 'dout'
                   if (0)                                          \
                   ^
   fs/ceph/mds_client.c:786:2: note: Loop condition is false.  Exiting loop
           dout("__unregister_session mds%d %p\n", s->s_mds, s);
           ^
   include/linux/ceph/ceph_debug.h:24:26: note: expanded from macro 'dout'
   #  define dout(fmt, ...)        do {                            \
                                   ^
   fs/ceph/mds_client.c:787:2: note: Assuming the condition is false
           BUG_ON(mdsc->sessions[s->s_mds] != s);
           ^
   include/asm-generic/bug.h:161:36: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                      ^~~~~~~~~~~~~~~~~~~
   include/linux/compiler.h:78:22: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:787:2: note: Taking false branch
           BUG_ON(mdsc->sessions[s->s_mds] != s);
           ^
   include/asm-generic/bug.h:161:32: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                  ^
   fs/ceph/mds_client.c:787:2: note: Loop condition is false.  Exiting loop
           BUG_ON(mdsc->sessions[s->s_mds] != s);
           ^
   include/asm-generic/bug.h:161:27: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                             ^
   fs/ceph/mds_client.c:790:2: note: Calling 'ceph_put_mds_session'
           ceph_put_mds_session(s);
           ^~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:668:2: note: Taking false branch
           if (IS_ERR_OR_NULL(s))
           ^
   fs/ceph/mds_client.c:671:2: note: Taking false branch
           dout("mdsc put_session %p %d -> %d\n", s,
           ^
   include/linux/ceph/ceph_debug.h:25:3: note: expanded from macro 'dout'
                   if (0)                                          \
                   ^
   fs/ceph/mds_client.c:671:2: note: Loop condition is false.  Exiting loop
           dout("mdsc put_session %p %d -> %d\n", s,
           ^
   include/linux/ceph/ceph_debug.h:24:26: note: expanded from macro 'dout'
   #  define dout(fmt, ...)        do {                            \
                                   ^
   fs/ceph/mds_client.c:673:2: note: Taking true branch
           if (refcount_dec_and_test(&s->s_ref)) {
           ^
   fs/ceph/mds_client.c:674:7: note: Assuming field 'authorizer' is null
                   if (s->s_auth.authorizer)
                       ^~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:674:3: note: Taking false branch
                   if (s->s_auth.authorizer)
                   ^
   fs/ceph/mds_client.c:676:3: note: Assuming the condition is false
                   WARN_ON(mutex_is_locked(&s->s_mutex));
                   ^
   include/asm-generic/bug.h:166:23: note: expanded from macro 'WARN_ON'
           int __ret_warn_on = !!(condition);                              \
                                ^~~~~~~~~~~~
   fs/ceph/mds_client.c:678:3: note: Memory is released
                   kfree(s);
                   ^~~~~~~~
   fs/ceph/mds_client.c:790:2: note: Returning; memory was released via 1st parameter
           ceph_put_mds_session(s);
           ^~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4938:4: note: Returning; memory was released via 2nd parameter
                           __unregister_session(mdsc, session);
                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4943:3: note: Use of memory after it is freed
                   __close_session(mdsc, session);
                   ^                     ~~~~~~~
   fs/ceph/mds_client.c:5083:2: warning: Value stored to 'maplen' is never read [clang-analyzer-deadcode.DeadStores]
           maplen = ceph_decode_32(&p);
           ^        ~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:5083:2: note: Value stored to 'maplen' is never read
           maplen = ceph_decode_32(&p);
           ^        ~~~~~~~~~~~~~~~~~~
>> include/linux/ceph/mdsmap.h:56:9: warning: Dereference of null pointer [clang-analyzer-core.NullDereference]
           return m->m_info[w].state;
                  ^
   fs/ceph/mds_client.c:4180:2: note: Taking false branch
           dout("check_new_map new %u old %u\n",
           ^
   include/linux/ceph/ceph_debug.h:25:3: note: expanded from macro 'dout'
                   if (0)                                          \
                   ^
   fs/ceph/mds_client.c:4180:2: note: Loop condition is false.  Exiting loop
           dout("check_new_map new %u old %u\n",
           ^
   include/linux/ceph/ceph_debug.h:24:26: note: expanded from macro 'dout'
   #  define dout(fmt, ...)        do {                            \
                                   ^
   fs/ceph/mds_client.c:4183:6: note: Assuming field 'm_info' is null
           if (newmap->m_info) {
               ^~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4183:2: note: Taking false branch
           if (newmap->m_info) {
           ^
   fs/ceph/mds_client.c:4190:14: note: Assuming 'i' is >= field 'possible_max_rank'
           for (i = 0; i < oldmap->possible_max_rank && i < mdsc->max_sessions; i++) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4190:44: note: Left side of '&&' is false
           for (i = 0; i < oldmap->possible_max_rank && i < mdsc->max_sessions; i++) {
                                                     ^
   fs/ceph/mds_client.c:4269:14: note: Assuming 'i' is < field 'possible_max_rank'
           for (i = 0; i < newmap->possible_max_rank; i++) {
                       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   fs/ceph/mds_client.c:4269:2: note: Loop condition is true.  Entering loop body
           for (i = 0; i < newmap->possible_max_rank; i++) {
           ^
   fs/ceph/mds_client.c:4282:14: note: Calling 'ceph_mdsmap_get_state'
                   newstate = ceph_mdsmap_get_state(newmap, i);
                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   include/linux/ceph/mdsmap.h:53:2: note: Taking false branch
           BUG_ON(w < 0);
           ^
   include/asm-generic/bug.h:161:32: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                                  ^
   include/linux/ceph/mdsmap.h:53:2: note: Loop condition is false.  Exiting loop
           BUG_ON(w < 0);
           ^
   include/asm-generic/bug.h:161:27: note: expanded from macro 'BUG_ON'
   #define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while (0)
                             ^
   include/linux/ceph/mdsmap.h:54:6: note: 'w' is < field 'possible_max_rank'
           if (w >= m->possible_max_rank)
               ^
   include/linux/ceph/mdsmap.h:54:2: note: Taking false branch
           if (w >= m->possible_max_rank)
           ^
   include/linux/ceph/mdsmap.h:56:9: note: Dereference of null pointer
           return m->m_info[w].state;
                  ^~~~~~~~~~~~~~~~~~
   Suppressed 16 warnings (16 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   16 warnings generated.
   Suppressed 16 warnings (16 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   17 warnings generated.
   fs/afs/server.c:709:3: warning: Value stored to 'ret' is never read [clang-analyzer-deadcode.DeadStores]
                   ret = -ESTALE;
                   ^     ~~~~~~~
   fs/afs/server.c:709:3: note: Value stored to 'ret' is never read
                   ret = -ESTALE;
                   ^     ~~~~~~~
   Suppressed 16 warnings (16 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   16 warnings generated.
   Suppressed 16 warnings (16 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   17 warnings generated.
   fs/afs/super.c:716:20: warning: Value stored to 'vnode' during its initialization is never read [clang-analyzer-deadcode.DeadStores]
           struct afs_vnode *vnode = AFS_FS_I(inode);
                             ^~~~~   ~~~~~~~~~~~~~~~
   fs/afs/super.c:716:20: note: Value stored to 'vnode' during its initialization is never read
           struct afs_vnode *vnode = AFS_FS_I(inode);
                             ^~~~~   ~~~~~~~~~~~~~~~
   Suppressed 16 warnings (16 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   16 warnings generated.
   Suppressed 16 warnings (16 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   16 warnings generated.
   Suppressed 16 warnings (16 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   16 warnings generated.
   Suppressed 16 warnings (16 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
   17 warnings generated.
   fs/afs/vl_probe.c:51:15: warning: Value stored to 'server_index' during its initialization is never read [clang-analyzer-deadcode.DeadStores]
           unsigned int server_index = call->server_index;
                        ^~~~~~~~~~~~   ~~~~~~~~~~~~~~~~~~
   fs/afs/vl_probe.c:51:15: note: Value stored to 'server_index' during its initialization is never read
           unsigned int server_index = call->server_index;
                        ^~~~~~~~~~~~   ~~~~~~~~~~~~~~~~~~
   Suppressed 16 warnings (16 in non-user code).
   Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.

vim +56 include/linux/ceph/mdsmap.h

2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  50  
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  51  static inline int ceph_mdsmap_get_state(struct ceph_mdsmap *m, int w)
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  52  {
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  53  	BUG_ON(w < 0);
b38c9eb4757d5b include/linux/ceph/mdsmap.h Xiubo Li  2019-12-04  54  	if (w >= m->possible_max_rank)
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  55  		return CEPH_MDS_STATE_DNE;
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06 @56  	return m->m_info[w].state;
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  57  }
2f2dc053404feb fs/ceph/mdsmap.h            Sage Weil 2009-10-06  58  

:::::: The code at line 56 was first introduced by commit
:::::: 2f2dc053404febedc9c273452d9d518fb31fde72 ceph: MDS client

:::::: TO: Sage Weil <sage@newdream.net>
:::::: CC: Sage Weil <sage@newdream.net>

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2023-03-04 20:43 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-02-02 10:16 include/linux/ceph/mdsmap.h:56:9: warning: Dereference of null pointer [clang-analyzer-core.NullDereference] kernel test robot
  -- strict thread matches above, loose matches on Subject: below --
2023-03-04 20:42 kernel test robot
2022-01-30  1:10 kernel test robot
2021-12-19 16:02 kernel test robot

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.