CC: llvm(a)lists.linux.dev CC: kbuild-all(a)lists.01.org In-Reply-To: <20211028130027.18764-1-tiwai(a)suse.de&gt; References: <20211028130027.18764-1-tiwai(a)suse.de&gt; TO: Takashi Iwai <tiwai(a)suse.de&gt; Hi Takashi, [FYI, it's a private test report for your RFC patch.] [auto build test WARNING on tiwai-sound/for-next] [also build test WARNING on v5.15-rc7 next-20211029] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch] url: https://github.com/0day-ci/linux/commits/Takashi-Iwai/ALSA-control-Use-xa... base: https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git for-next :::::: branch date: 2 days ago :::::: commit date: 2 days ago config: arm-randconfig-c002-20211028 (attached as .config) compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 5db7568a6a1fcb408eb8988abdaff2a225a8eb72) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # install arm cross compiling tool for clang build # apt-get install binutils-arm-linux-gnueabi # https://github.com/0day-ci/linux/commit/d9e50e9647a202433a7b1c261b0edb002... git remote add linux-review https://github.com/0day-ci/linux git fetch --no-tags linux-review Takashi-Iwai/ALSA-control-Use-xarray-for-faster-lookups/20211028-210215 git checkout d9e50e9647a202433a7b1c261b0edb0021f16004 # save the attached .config to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm clang-analyzer If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp(a)intel.com&gt; clang-analyzer warnings: (new ones prefixed by >>) note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/compiler_types.h:322:2: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:310:2: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ^ include/linux/compiler_types.h:302:3: note: expanded from macro '__compiletime_assert' if (!(condition)) \ ^ sound/core/control.c:103:11: note: Loop condition is false. Exiting loop cread = snd_kctl_event(ctl->events.next); ^ include/sound/control.h:95:27: note: expanded from macro 'snd_kctl_event' #define snd_kctl_event(n) list_entry(n, struct snd_kctl_event, list) ^ include/linux/list.h:511:2: note: expanded from macro 'list_entry' container_of(ptr, type, member) ^ include/linux/kernel.h:495:2: note: expanded from macro 'container_of' BUILD_BUG_ON_MSG(!__same_type(*(ptr), ((type *)0)->member) && \ ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/compiler_types.h:322:2: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:310:2: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ^ include/linux/compiler_types.h:300:2: note: expanded from macro '__compiletime_assert' do { \ ^ sound/core/control.c:105:3: note: Memory is released kfree(cread); ^~~~~~~~~~~~ sound/core/control.c:102:2: note: Loop condition is true. Entering loop body while (!list_empty(&ctl->events)) { ^ sound/core/control.c:103:11: note: Left side of '&&' is false cread = snd_kctl_event(ctl->events.next); ^ include/sound/control.h:95:27: note: expanded from macro 'snd_kctl_event' #define snd_kctl_event(n) list_entry(n, struct snd_kctl_event, list) ^ include/linux/list.h:511:2: note: expanded from macro 'list_entry' container_of(ptr, type, member) ^ include/linux/kernel.h:495:61: note: expanded from macro 'container_of' BUILD_BUG_ON_MSG(!__same_type(*(ptr), ((type *)0)->member) && \ ^ sound/core/control.c:103:11: note: Taking false branch cread = snd_kctl_event(ctl->events.next); ^ include/sound/control.h:95:27: note: expanded from macro 'snd_kctl_event' #define snd_kctl_event(n) list_entry(n, struct snd_kctl_event, list) ^ include/linux/list.h:511:2: note: expanded from macro 'list_entry' container_of(ptr, type, member) ^ include/linux/kernel.h:495:2: note: expanded from macro 'container_of' BUILD_BUG_ON_MSG(!__same_type(*(ptr), ((type *)0)->member) && \ ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/compiler_types.h:322:2: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:310:2: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ^ include/linux/compiler_types.h:302:3: note: expanded from macro '__compiletime_assert' if (!(condition)) \ ^ sound/core/control.c:103:11: note: Loop condition is false. Exiting loop cread = snd_kctl_event(ctl->events.next); ^ include/sound/control.h:95:27: note: expanded from macro 'snd_kctl_event' #define snd_kctl_event(n) list_entry(n, struct snd_kctl_event, list) ^ include/linux/list.h:511:2: note: expanded from macro 'list_entry' container_of(ptr, type, member) ^ include/linux/kernel.h:495:2: note: expanded from macro 'container_of' BUILD_BUG_ON_MSG(!__same_type(*(ptr), ((type *)0)->member) && \ ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/compiler_types.h:322:2: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:310:2: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ^ include/linux/compiler_types.h:300:2: note: expanded from macro '__compiletime_assert' do { \ ^ sound/core/control.c:104:3: note: Calling 'list_del' list_del(&cread->list); ^~~~~~~~~~~~~~~~~~~~~~ include/linux/list.h:147:14: note: Use of memory after it is freed entry->next = LIST_POISON1; ~~~~~~~~~~~ ^ err = xa_insert(&card->ctl_hash, get_ctl_id_hash(&id), ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/core/control.c:412:3: note: Value stored to 'err' is never read err = xa_insert(&card->ctl_hash, get_ctl_id_hash(&id), ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/core/control.c:1381:2: warning: Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119 [clang-analyzer-security.insecureAPI.strcpy] strcpy(uinfo->value.enumerated.name, names); ^~~~~~ sound/core/control.c:1381:2: note: Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119 strcpy(uinfo->value.enumerated.name, names); ^~~~~~ sound/core/control.c:2273:3: warning: Use of memory after it is freed [clang-analyzer-unix.Malloc] __snd_ctl_remove(card, control, false); ^ ~~~~~~~ sound/core/control.c:2271:2: note: Loop condition is true. Entering loop body while (!list_empty(&card->controls)) { ^ sound/core/control.c:2272:13: note: Left side of '&&' is false control = snd_kcontrol(card->controls.next); ^ include/sound/control.h:87:25: note: expanded from macro 'snd_kcontrol' #define snd_kcontrol(n) list_entry(n, struct snd_kcontrol, list) ^ include/linux/list.h:511:2: note: expanded from macro 'list_entry' container_of(ptr, type, member) ^ include/linux/kernel.h:495:61: note: expanded from macro 'container_of' BUILD_BUG_ON_MSG(!__same_type(*(ptr), ((type *)0)->member) && \ ^ sound/core/control.c:2272:13: note: Taking false branch control = snd_kcontrol(card->controls.next); ^ include/sound/control.h:87:25: note: expanded from macro 'snd_kcontrol' #define snd_kcontrol(n) list_entry(n, struct snd_kcontrol, list) ^ include/linux/list.h:511:2: note: expanded from macro 'list_entry' container_of(ptr, type, member) ^ include/linux/kernel.h:495:2: note: expanded from macro 'container_of' BUILD_BUG_ON_MSG(!__same_type(*(ptr), ((type *)0)->member) && \ ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/compiler_types.h:322:2: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:310:2: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ^ include/linux/compiler_types.h:302:3: note: expanded from macro '__compiletime_assert' if (!(condition)) \ ^ sound/core/control.c:2272:13: note: Loop condition is false. Exiting loop control = snd_kcontrol(card->controls.next); ^ include/sound/control.h:87:25: note: expanded from macro 'snd_kcontrol' #define snd_kcontrol(n) list_entry(n, struct snd_kcontrol, list) ^ include/linux/list.h:511:2: note: expanded from macro 'list_entry' container_of(ptr, type, member) ^ include/linux/kernel.h:495:2: note: expanded from macro 'container_of' BUILD_BUG_ON_MSG(!__same_type(*(ptr), ((type *)0)->member) && \ ^ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) include/linux/compiler_types.h:322:2: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:310:2: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ^ include/linux/compiler_types.h:300:2: note: expanded from macro '__compiletime_assert' do { \ ^ sound/core/control.c:2273:3: note: Calling '__snd_ctl_remove' __snd_ctl_remove(card, control, false); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/core/control.c:562:18: note: 'card' is non-null if (snd_BUG_ON(!card || !kcontrol)) ^ include/sound/core.h:416:25: note: expanded from macro 'snd_BUG_ON' int __ret_warn_on = !!(condition); \ ^~~~~~~~~ sound/core/control.c:562:17: note: Left side of '||' is false if (snd_BUG_ON(!card || !kcontrol)) ^ sound/core/control.c:562:26: note: Assuming 'kcontrol' is non-null if (snd_BUG_ON(!card || !kcontrol)) ^ include/sound/core.h:416:25: note: expanded from macro 'snd_BUG_ON' int __ret_warn_on = !!(condition); \ ^~~~~~~~~ sound/core/control.c:562:2: note: Taking false branch if (snd_BUG_ON(!card || !kcontrol)) ^ sound/core/control.c:566:6: note: 'remove_hash' is false if (remove_hash) ^~~~~~~~~~~ sound/core/control.c:566:2: note: Taking false branch if (remove_hash) ^ vim +/err +412 sound/core/control.c d9e50e9647a202 Takashi Iwai 2021-10-28 398 d9e50e9647a202 Takashi Iwai 2021-10-28 399 /* add hash entries to numid and ctl xarray tables */ d9e50e9647a202 Takashi Iwai 2021-10-28 400 static void add_hash_entries(struct snd_card *card, d9e50e9647a202 Takashi Iwai 2021-10-28 401 struct snd_kcontrol *kcontrol) d9e50e9647a202 Takashi Iwai 2021-10-28 402 { d9e50e9647a202 Takashi Iwai 2021-10-28 403 struct snd_ctl_elem_id id = kcontrol->id; d9e50e9647a202 Takashi Iwai 2021-10-28 404 int i, err; d9e50e9647a202 Takashi Iwai 2021-10-28 405 d9e50e9647a202 Takashi Iwai 2021-10-28 406 xa_store_range(&card->ctl_numids, kcontrol->id.numid, d9e50e9647a202 Takashi Iwai 2021-10-28 407 kcontrol->id.numid + kcontrol->count - 1, d9e50e9647a202 Takashi Iwai 2021-10-28 408 kcontrol, GFP_KERNEL); d9e50e9647a202 Takashi Iwai 2021-10-28 409 d9e50e9647a202 Takashi Iwai 2021-10-28 410 for (i = 0; i < kcontrol->count; i++) { d9e50e9647a202 Takashi Iwai 2021-10-28 411 id.index = kcontrol->id.index + i; d9e50e9647a202 Takashi Iwai 2021-10-28 @412 err = xa_insert(&card->ctl_hash, get_ctl_id_hash(&id), d9e50e9647a202 Takashi Iwai 2021-10-28 413 kcontrol, GFP_KERNEL); d9e50e9647a202 Takashi Iwai 2021-10-28 414 /* ignore errors - it's a best effort */ d9e50e9647a202 Takashi Iwai 2021-10-28 415 } d9e50e9647a202 Takashi Iwai 2021-10-28 416 } d9e50e9647a202 Takashi Iwai 2021-10-28 417 --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org