Re: [PATCH 2/7] libata: cleanup ata_dev_configure()

[kernel test robot]

Hi Damien,

I love your patch! Perhaps something to improve:

[auto build test WARNING on block/for-next]
[also build test WARNING on mkp-scsi/for-next scsi/for-next v5.14-rc3
next-20210730]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:
https://github.com/0day-ci/linux/commits/Damien-Le-Moal/libata-cleanups-and-improvements/20210802-170443
base:
https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git
for-next
:::::: branch date: 9 hours ago
:::::: commit date: 9 hours ago
config: x86_64-randconfig-c001-20210802 (attached as .config)
compiler: clang version 13.0.0 (https://github.com/llvm/llvm-project
4f71f59bf3d9914188a11d0c41bedbb339d36ff5)
reproduce (this is a W=1 build):
wget
https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross
-O ~/bin/make.cross
chmod +x ~/bin/make.cross
# install x86_64 cross compiling tool for clang build
# apt-get install binutils-x86-64-linux-gnu
#
https://github.com/0day-ci/linux/commit/5622af0f73c9776b5bdf272dee77d57d62ea03fa
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review
Damien-Le-Moal/libata-cleanups-and-improvements/20210802-170443
git checkout 5622af0f73c9776b5bdf272dee77d57d62ea03fa
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross
ARCH=x86_64 clang-analyzer
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <l...@intel.com>


clang-analyzer warnings: (new ones prefixed by >>)
note: (skipping 3 expansions in backtrace; use
-fmacro-backtrace-limit=0 to see all)
include/linux/minmax.h:104:48: note: expanded from macro 'min_t'
#define min_t(type, x, y) __careful_cmp((type)(x), (type)(y), <)
~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~
include/linux/minmax.h:38:14: note: expanded from macro '__careful_cmp'
__cmp_once(x, y, __UNIQUE_ID(__x), __UNIQUE_ID(__y),
op))
~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/minmax.h:31:25: note: expanded from macro '__cmp_once'
typeof(x) unique_x = (x); \
^
drivers/hwmon/max6621.c:321:10: note: '?' condition is false
val = clamp_val(val, MAX6621_TEMP_INPUT_MIN,
^
include/linux/minmax.h:137:32: note: expanded from macro 'clamp_val'
#define clamp_val(val, lo, hi) clamp_t(typeof(val), val, lo, hi)
^
include/linux/minmax.h:124:48: note: expanded from macro 'clamp_t'
#define clamp_t(type, val, lo, hi) min_t(type, max_t(type, val, lo), hi)
^
include/linux/minmax.h:112:27: note: expanded from macro 'max_t'
#define max_t(type, x, y) __careful_cmp((type)(x), (type)(y), >)
^
include/linux/minmax.h:38:3: note: expanded from macro '__careful_cmp'
__cmp_once(x, y, __UNIQUE_ID(__x), __UNIQUE_ID(__y),
op))
^
include/linux/minmax.h:33:3: note: expanded from macro '__cmp_once'
__cmp(unique_x, unique_y, op); })
^
include/linux/minmax.h:28:26: note: expanded from macro '__cmp'
#define __cmp(x, y, op) ((x) op (y) ? (x) : (y))
^
drivers/hwmon/max6621.c:321:10: note: '__UNIQUE_ID___x523' is <
'__UNIQUE_ID___y524'
val = clamp_val(val, MAX6621_TEMP_INPUT_MIN,
^
include/linux/minmax.h:137:32: note: expanded from macro 'clamp_val'
#define clamp_val(val, lo, hi) clamp_t(typeof(val), val, lo, hi)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/minmax.h:124:36: note: expanded from macro 'clamp_t'
#define clamp_t(type, val, lo, hi) min_t(type, max_t(type, val, lo), hi)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/minmax.h:104:27: note: expanded from macro 'min_t'
#define min_t(type, x, y) __careful_cmp((type)(x), (type)(y), <)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/minmax.h:38:3: note: expanded from macro '__careful_cmp'
__cmp_once(x, y, __UNIQUE_ID(__x), __UNIQUE_ID(__y),
op))
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/minmax.h:33:3: note: expanded from macro '__cmp_once'
__cmp(unique_x, unique_y, op); })
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/minmax.h:28:26: note: expanded from macro '__cmp'
#define __cmp(x, y, op) ((x) op (y) ? (x) : (y))
^~~
drivers/hwmon/max6621.c:321:10: note: '?' condition is true
val = clamp_val(val, MAX6621_TEMP_INPUT_MIN,
^
include/linux/minmax.h:137:32: note: expanded from macro 'clamp_val'
#define clamp_val(val, lo, hi) clamp_t(typeof(val), val, lo, hi)
^
include/linux/minmax.h:124:36: note: expanded from macro 'clamp_t'
#define clamp_t(type, val, lo, hi) min_t(type, max_t(type, val, lo), hi)
^
include/linux/minmax.h:104:27: note: expanded from macro 'min_t'
#define min_t(type, x, y) __careful_cmp((type)(x), (type)(y), <)
^
include/linux/minmax.h:38:3: note: expanded from macro '__careful_cmp'
__cmp_once(x, y, __UNIQUE_ID(__x), __UNIQUE_ID(__y),
op))
^
include/linux/minmax.h:33:3: note: expanded from macro '__cmp_once'
__cmp(unique_x, unique_y, op); })
^
include/linux/minmax.h:28:26: note: expanded from macro '__cmp'
#define __cmp(x, y, op) ((x) op (y) ? (x) : (y))
^
drivers/hwmon/max6621.c:323:10: note: Calling 'max6621_temp_mc2reg'
val = max6621_temp_mc2reg(val);
^~~~~~~~~~~~~~~~~~~~~~~~
drivers/hwmon/max6621.c:135:23: note: The result of the left shift
is undefined because the left operand is negative
return (val / 1000L) << MAX6621_REG_TEMP_SHIFT;
~~~~~~~~~~~~~ ^
Suppressed 8 warnings (8 in non-user code).
Use -header-filter=.* to display errors from all non-system headers.
Use -system-headers to display errors from system headers as well.
9 warnings generated.
Suppressed 9 warnings (8 in non-user code, 1 with check filters).
Use -header-filter=.* to display errors from all non-system headers.
Use -system-headers to display errors from system headers as well.
9 warnings generated.
Suppressed 9 warnings (8 in non-user code, 1 with check filters).
Use -header-filter=.* to display errors from all non-system headers.
Use -system-headers to display errors from system headers as well.
9 warnings generated.
Suppressed 9 warnings (8 in non-user code, 1 with check filters).
Use -header-filter=.* to display errors from all non-system headers.
Use -system-headers to display errors from system headers as well.
12 warnings generated.
drivers/nvme/target/fcloop.c:1226:3: warning: Value stored to 'ret'
is never read [clang-analyzer-deadcode.DeadStores]
ret = -EINVAL;
^ ~~~~~~~
drivers/nvme/target/fcloop.c:1226:3: note: Value stored to 'ret' is
never read
ret = -EINVAL;
^ ~~~~~~~
Suppressed 11 warnings (11 in non-user code).
Use -header-filter=.* to display errors from all non-system headers.
Use -system-headers to display errors from system headers as well.
15 warnings generated.
>> drivers/ata/libata-core.c:2376:3: warning: Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119 [clang-analyzer-security.insecureAPI.strcpy]
strcpy(info, "LBA48 ");
^~~~~~
drivers/ata/libata-core.c:2376:3: note: Call to function 'strcpy' is
insecure as it does not provide bounding of the memory buffer. Replace
unbounded copy functions with analogous functions that support length
arguments such as 'strlcpy'. CWE-119
strcpy(info, "LBA48 ");
^~~~~~
drivers/ata/libata-core.c:2382:3: warning: Call to function 'strcpy'
is insecure as it does not provide bounding of the memory buffer.
Replace unbounded copy functions with analogous functions that support
length arguments such as 'strlcpy'. CWE-119
[clang-analyzer-security.insecureAPI.strcpy]
strcpy(info, "LBA ");
^~~~~~
drivers/ata/libata-core.c:2382:3: note: Call to function 'strcpy' is
insecure as it does not provide bounding of the memory buffer. Replace
unbounded copy functions with analogous functions that support length
arguments such as 'strlcpy'. CWE-119
strcpy(info, "LBA ");
^~~~~~
drivers/ata/libata-core.c:5471:18: warning: Access to field
'pio_mask' results in a dereference of a null pointer (loaded from
variable 'pi') [clang-analyzer-core.NullDereference]
ap->pio_mask = pi->pio_mask;
^~
drivers/ata/libata-core.c:5462:6: note: Assuming 'host' is non-null
if (!host)
^~~~~
drivers/ata/libata-core.c:5462:2: note: Taking false branch
if (!host)
^
drivers/ata/libata-core.c:5465:21: note: Null pointer value stored
to 'pi'
for (i = 0, j = 0, pi = NULL; i < host->n_ports; i++) {
^~~~~~~~~
drivers/ata/libata-core.c:5465:32: note: Assuming 'i' is < field
'n_ports'
for (i = 0, j = 0, pi = NULL; i < host->n_ports; i++) {
^~~~~~~~~~~~~~~~~
drivers/ata/libata-core.c:5465:2: note: Loop condition is true.
Entering loop body
for (i = 0, j = 0, pi = NULL; i < host->n_ports; i++) {
^
drivers/ata/libata-core.c:5468:7: note: Assuming the condition is false
if (ppi[j])
^~~~~~
drivers/ata/libata-core.c:5468:3: note: Taking false branch
if (ppi[j])
^
drivers/ata/libata-core.c:5471:18: note: Access to field 'pio_mask'
results in a dereference of a null pointer (loaded from variable 'pi')
ap->pio_mask = pi->pio_mask;
^~
drivers/ata/libata-core.c:5593:6: warning: Access to field
'host_stop' results in a dereference of a null pointer (loaded from
field 'ops') [clang-analyzer-core.NullDereference]
if (host->ops->host_stop)
^
drivers/ata/libata-core.c:5840:7: note: Calling 'ata_host_start'
rc = ata_host_start(host);
^~~~~~~~~~~~~~~~~~~~
drivers/ata/libata-core.c:5576:6: note: Assuming the condition is false
if (host->flags & ATA_HOST_STARTED)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/ata/libata-core.c:5576:2: note: Taking false branch
if (host->flags & ATA_HOST_STARTED)
^
drivers/ata/libata-core.c:5581:14: note: Assuming 'i' is < field
'n_ports'
for (i = 0; i < host->n_ports; i++) {
^~~~~~~~~~~~~~~~~
drivers/ata/libata-core.c:5581:2: note: Loop condition is true.
Entering loop body
for (i = 0; i < host->n_ports; i++) {
^
drivers/ata/libata-core.c:5586:7: note: Assuming field 'ops' is null
if (!host->ops && !ata_port_is_dummy(ap))
^~~~~~~~~~
drivers/ata/libata-core.c:5586:7: note: Assuming pointer value is null
if (!host->ops && !ata_port_is_dummy(ap))
^~~~~~~~~~
drivers/ata/libata-core.c:5586:7: note: Left side of '&&' is true
drivers/ata/libata-core.c:5586:21: note: Assuming the condition is false
if (!host->ops && !ata_port_is_dummy(ap))
^~~~~~~~~~~~~~~~~~~~~~
drivers/ata/libata-core.c:5586:3: note: Taking false branch
if (!host->ops && !ata_port_is_dummy(ap))
^
drivers/ata/libata-core.c:5589:7: note: Assuming field 'port_stop'
is null
if (ap->ops->port_stop)
^~~~~~~~~~~~~~~~~~
drivers/ata/libata-core.c:5589:3: note: Taking false branch
if (ap->ops->port_stop)
^
drivers/ata/libata-core.c:5581:14: note: Assuming 'i' is >= field
'n_ports'
for (i = 0; i < host->n_ports; i++) {
^~~~~~~~~~~~~~~~~
drivers/ata/libata-core.c:5581:2: note: Loop condition is false.
Execution continues on line 5593
for (i = 0; i < host->n_ports; i++) {
^
drivers/ata/libata-core.c:5593:6: note: Access to field 'host_stop'
results in a dereference of a null pointer (loaded from field 'ops')
if (host->ops->host_stop)
^ ~~~
Suppressed 11 warnings (11 in non-user code).
Use -header-filter=.* to display errors from all non-system headers.
Use -system-headers to display errors from system headers as well.
8 warnings generated.
include/linux/hid.h:1007:9: warning: Access to field 'name' results
in a dereference of a null pointer (loaded from variable 'input')
[clang-analyzer-core.NullDereference]
input->name, c, type);
^
drivers/hid/hid-lenovo.c:321:2: note: Control jumps to 'case 12544:'
at line 329
switch (hdev->product) {
^
drivers/hid/hid-lenovo.c:335:10: note: Calling
'lenovo_input_mapping_scrollpoint'
return lenovo_input_mapping_scrollpoint(hdev, hi, field,
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/hid/hid-lenovo.c:224:6: note: Assuming field 'hid' is equal
to HID_GD_Z
if (usage->hid == HID_GD_Z) {
^~~~~~~~~~~~~~~~~~~~~~
drivers/hid/hid-lenovo.c:224:2: note: Taking true branch

vim +2376 drivers/ata/libata-core.c

818831c8b22f75 Christoph Hellwig 2017-06-04 2365 5622af0f73c977 Damien
Le Moal 2021-08-02 2366 static int ata_dev_config_lba(struct
ata_device *dev,
5622af0f73c977 Damien Le Moal 2021-08-02 2367 char *info,
size_t infosz)
5622af0f73c977 Damien Le Moal 2021-08-02 2368 {
5622af0f73c977 Damien Le Moal 2021-08-02 2369 const u16 *id = dev->id;
5622af0f73c977 Damien Le Moal 2021-08-02 2370 int info_ofst;
5622af0f73c977 Damien Le Moal 2021-08-02 2371 5622af0f73c977 Damien
Le Moal 2021-08-02 2372 dev->flags |= ATA_DFLAG_LBA;
5622af0f73c977 Damien Le Moal 2021-08-02 2373 5622af0f73c977 Damien
Le Moal 2021-08-02 2374 if (ata_id_has_lba48(id)) {
5622af0f73c977 Damien Le Moal 2021-08-02 2375 dev->flags |=
ATA_DFLAG_LBA48;
5622af0f73c977 Damien Le Moal 2021-08-02 @2376 strcpy(info, "LBA48 ");
5622af0f73c977 Damien Le Moal 2021-08-02 2377 5622af0f73c977 Damien
Le Moal 2021-08-02 2378 if (dev->n_sectors >= (1UL << 28) &&
5622af0f73c977 Damien Le Moal 2021-08-02 2379
ata_id_has_flush_ext(id))
5622af0f73c977 Damien Le Moal 2021-08-02 2380 dev->flags |=
ATA_DFLAG_FLUSH_EXT;
5622af0f73c977 Damien Le Moal 2021-08-02 2381 } else {
5622af0f73c977 Damien Le Moal 2021-08-02 2382 strcpy(info, "LBA ");
5622af0f73c977 Damien Le Moal 2021-08-02 2383 }
5622af0f73c977 Damien Le Moal 2021-08-02 2384 info_ofst =
strlen(info);
5622af0f73c977 Damien Le Moal 2021-08-02 2385 5622af0f73c977 Damien
Le Moal 2021-08-02 2386 /* config NCQ */
5622af0f73c977 Damien Le Moal 2021-08-02 2387 return
ata_dev_config_ncq(dev, info + info_ofst,
5622af0f73c977 Damien Le Moal 2021-08-02 2388 infosz -
info_ofst);
5622af0f73c977 Damien Le Moal 2021-08-02 2389 }
5622af0f73c977 Damien Le Moal 2021-08-02 2390
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuil...@lists.01.org