Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

clang doesn't emit the same warnings for global variables #92

Open
nickdesaulniers opened this issue Sep 17, 2018 · 9 comments
Open

clang doesn't emit the same warnings for global variables #92

nickdesaulniers opened this issue Sep 17, 2018 · 9 comments
Labels
[BUG] llvm A bug that should be fixed in upstream LLVM known difference known difference between GNU and LLVM; maybe unresolvable low priority This bug is not critical and not a priority [PATCH] Bitrot Patch is outdated and needs to be refreshed or revisited [WORKAROUND] Applied This bug has an applied workaround

Comments

@nickdesaulniers
Copy link
Member

nickdesaulniers commented Sep 17, 2018

https://llvm.org/pr38789

@nickdesaulniers nickdesaulniers added the [BUG] llvm A bug that should be fixed in upstream LLVM label Sep 17, 2018
nathanchance pushed a commit that referenced this issue Mar 7, 2019
Currently, this will hit a BUG_ON for these symlinks as follows:

- kernel message
------------[ cut here ]------------
kernel BUG at drivers/staging/erofs/xattr.c:59!
SMP PTI
CPU: 1 PID: 1170 Comm: getllxattr Not tainted 4.20.0-rc6+ #92
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014
RIP: 0010:init_inode_xattrs+0x22b/0x270
Code: 48 0f 45 ea f0 ff 4d 34 74 0d 41 83 4c 24 e0 01 31 c0 e9 00 fe ff ff 48 89 ef e8 e0 31 9e ff eb e9 89 e8 e9 ef fd ff ff 0f 0$
 <0f> 0b 48 89 ef e8 fb f6 9c ff 48 8b 45 08 a8 01 75 24 f0 ff 4d 34
RSP: 0018:ffffa03ac026bdf8 EFLAGS: 00010246
------------[ cut here ]------------
...
Call Trace:
 erofs_listxattr+0x30/0x2c0
 ? selinux_inode_listxattr+0x5a/0x80
 ? kmem_cache_alloc+0x33/0x170
 ? security_inode_listxattr+0x27/0x40
 listxattr+0xaf/0xc0
 path_listxattr+0x5a/0xa0
 do_syscall_64+0x43/0xf0
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
...
---[ end trace 3c24b49408dc0c72 ]---

Fix it by checking ->xattr_isize in init_inode_xattrs(),
and it also fixes improper return value -ENOTSUPP
(it should be -ENODATA if xattr is enabled) for those inodes.

Fixes: b17500a ("staging: erofs: introduce xattr & acl support")
Cc: <stable@vger.kernel.org> # 4.19+
Reported-by: Li Guifu <bluce.liguifu@huawei.com>
Tested-by: Li Guifu <bluce.liguifu@huawei.com>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
@nickdesaulniers
Copy link
Member Author

I plan on revisiting this later this quarter.

@nickdesaulniers nickdesaulniers self-assigned this Apr 13, 2019
@nickdesaulniers
Copy link
Member Author

Posting what @zygoloid sent me about this:

I think it should not require major invasive changes to Clang to fix this. While we can't built a CFG for the initializer of a global variable, we don't really need to, since there's never any control flow there (you can't have a statement-expression at global scope). So we could just walk the initializer after attaching it, skip obviously-dead branches in ?: expressions, and emit deferred runtime-behavior diagnostics for the rest. (And ideally we'd skip all of that if we don't have any pending runtime-behavior diagnostics when we reach the end of a global's initializer.)

@nickdesaulniers
Copy link
Member Author

@nickdesaulniers nickdesaulniers added the [PATCH] Submitted A patch has been submitted for review label Jul 21, 2019
nathanchance pushed a commit that referenced this issue Sep 18, 2019
…ing driver fails

If a gadget driver is in the pending drivers list, a UDC
becomes available and udc_bind_to_driver() fails, then it
gets deleted from the pending list.
i.e. list_del(&driver->pending) in check_pending_gadget_drivers().

Then if that gadget driver is unregistered,
usb_gadget_unregister_driver() does a list_del(&driver->pending)
again thus causing a page fault as that list entry has been poisoned
by the previous list_del().

Fix this by using list_del_init() instead of list_del() in
check_pending_gadget_drivers().

Test case:

- Make sure no UDC is available
- modprobe g_mass_storage file=wrongfile
- Load UDC driver so it becomes available
	lun0: unable to open backing file: wrongfile
- modprobe -r g_mass_storage

[   60.900431] Unable to handle kernel paging request at virtual address dead000000000108
[   60.908346] Mem abort info:
[   60.911145]   ESR = 0x96000044
[   60.914227]   Exception class = DABT (current EL), IL = 32 bits
[   60.920162]   SET = 0, FnV = 0
[   60.923217]   EA = 0, S1PTW = 0
[   60.926354] Data abort info:
[   60.929228]   ISV = 0, ISS = 0x00000044
[   60.933058]   CM = 0, WnR = 1
[   60.936011] [dead000000000108] address between user and kernel address ranges
[   60.943136] Internal error: Oops: 96000044 [#1] PREEMPT SMP
[   60.948691] Modules linked in: g_mass_storage(-) usb_f_mass_storage libcomposite xhci_plat_hcd xhci_hcd usbcore ti_am335x_adc kfifo_buf omap_rng cdns3 rng_core udc_core crc32_ce xfrm_user crct10dif_ce snd_so6
[   60.993995] Process modprobe (pid: 834, stack limit = 0x00000000c2aebc69)
[   61.000765] CPU: 0 PID: 834 Comm: modprobe Not tainted 4.19.59-01963-g065f42a60499 #92
[   61.008658] Hardware name: Texas Instruments SoC (DT)
[   61.014472] pstate: 60000005 (nZCv daif -PAN -UAO)
[   61.019253] pc : usb_gadget_unregister_driver+0x7c/0x108 [udc_core]
[   61.025503] lr : usb_gadget_unregister_driver+0x30/0x108 [udc_core]
[   61.031750] sp : ffff00001338fda0
[   61.035049] x29: ffff00001338fda0 x28: ffff800846d40000
[   61.040346] x27: 0000000000000000 x26: 0000000000000000
[   61.045642] x25: 0000000056000000 x24: 0000000000000800
[   61.050938] x23: ffff000008d7b0d0 x22: ffff0000088b07c8
[   61.056234] x21: ffff000001100000 x20: ffff000002020260
[   61.061530] x19: ffff0000010ffd28 x18: 0000000000000000
[   61.066825] x17: 0000000000000000 x16: 0000000000000000
[   61.072121] x15: 0000000000000000 x14: 0000000000000000
[   61.077417] x13: ffff000000000000 x12: ffffffffffffffff
[   61.082712] x11: 0000000000000030 x10: 7f7f7f7f7f7f7f7f
[   61.088008] x9 : fefefefefefefeff x8 : 0000000000000000
[   61.093304] x7 : ffffffffffffffff x6 : 000000000000ffff
[   61.098599] x5 : 8080000000000000 x4 : 0000000000000000
[   61.103895] x3 : ffff000001100020 x2 : ffff800846d40000
[   61.109190] x1 : dead000000000100 x0 : dead000000000200
[   61.114486] Call trace:
[   61.116922]  usb_gadget_unregister_driver+0x7c/0x108 [udc_core]
[   61.122828]  usb_composite_unregister+0x10/0x18 [libcomposite]
[   61.128643]  msg_cleanup+0x18/0xfce0 [g_mass_storage]
[   61.133682]  __arm64_sys_delete_module+0x17c/0x1f0
[   61.138458]  el0_svc_common+0x90/0x158
[   61.142192]  el0_svc_handler+0x2c/0x80
[   61.145926]  el0_svc+0x8/0xc
[   61.148794] Code: eb03003f d10be033 54ffff21 a94d0281 (f9000420)
[   61.154869] ---[ end trace afb22e9b637bd9a7 ]---
Segmentation fault

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
@nickdesaulniers nickdesaulniers added the low priority This bug is not critical and not a priority label Feb 8, 2020
@tpimh tpimh added low priority This bug is not critical and not a priority and removed low priority This bug is not critical and not a priority labels Apr 23, 2020
nathanchance pushed a commit that referenced this issue Jun 7, 2020
The threaded interrupt handler may still be called after the
usb_gadget_disconnect is called, it causes the structures used
at interrupt handler was freed before it uses, eg the
usb_request. This issue usually occurs we remove the udc function
during the transfer. Below is the example when doing stress
test for android switch function, the EP0's request is freed
by .unbind (configfs_composite_unbind -> composite_dev_cleanup),
but the threaded handler accesses this request during handling
setup packet request.

In fact, there is no protection between unbind the udc
and udc interrupt handling, so we have to avoid the interrupt
handler is occurred or scheduled during the .unbind flow.

init: Sending signal 9 to service 'adbd' (pid 18077) process group...
android_work: did not send uevent (0 0 000000007bec2039)
libprocessgroup: Successfully killed process cgroup uid 0 pid 18077 in 6ms
init: Service 'adbd' (pid 18077) received signal 9
init: Sending signal 9 to service 'adbd' (pid 18077) process group...
libprocessgroup: Successfully killed process cgroup uid 0 pid 18077 in 0ms
init: processing action (init.svc.adbd=stopped) from (/init.usb.configfs.rc:14)
init: Received control message 'start' for 'adbd' from pid: 399 (/vendor/bin/hw/android.hardware.usb@1.

init: starting service 'adbd'...
read descriptors
read strings
Unable to handle kernel read from unreadable memory at virtual address 000000000000002a
android_work: sent uevent USB_STATE=CONNECTED
Mem abort info:
  ESR = 0x96000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=00000000e97f1000
using random self ethernet address
[000000000000002a] pgd=0000000000000000
Internal error: Oops: 96000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 232 Comm: irq/68-5b110000 Not tainted 5.4.24-06075-g94a6b52b5815 #92
Hardware name: Freescale i.MX8QXP MEK (DT)
pstate: 00400085 (nzcv daIf +PAN -UAO)
using random host ethernet address
pc : composite_setup+0x5c/0x1730
lr : android_setup+0xc0/0x148
sp : ffff80001349bba0
x29: ffff80001349bba0 x28: ffff00083a50da00
x27: ffff8000124e6000 x26: ffff800010177950
x25: 0000000000000040 x24: ffff000834e18010
x23: 0000000000000000 x22: 0000000000000000
x21: ffff00083a50da00 x20: ffff00082e75ec40
x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000000000000000 x14: 0000000000000000
x13: 0000000000000000 x12: 0000000000000001
x11: ffff80001180fb58 x10: 0000000000000040
x9 : ffff8000120fc980 x8 : 0000000000000000
x7 : ffff00083f98df50 x6 : 0000000000000100
x5 : 00000307e8978431 x4 : ffff800011386788
x3 : 0000000000000000 x2 : ffff800012342000
x1 : 0000000000000000 x0 : ffff800010c6d3a0
Call trace:
 composite_setup+0x5c/0x1730
 android_setup+0xc0/0x148
 cdns3_ep0_delegate_req+0x64/0x90
 cdns3_check_ep0_interrupt_proceed+0x384/0x738
 cdns3_device_thread_irq_handler+0x124/0x6e0
 cdns3_thread_irq+0x94/0xa0
 irq_thread_fn+0x30/0xa0
 irq_thread+0x150/0x248
 kthread+0xfc/0x128
 ret_from_fork+0x10/0x18
Code: 910e8000 f9400693 12001ed7 79400f79 (3940aa61)
---[ end trace c685db37f8773fba ]---
Kernel panic - not syncing: Fatal exception
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x0002,20002008
Memory Limit: none
Rebooting in 5 seconds..

Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
nathanchance pushed a commit that referenced this issue Jul 31, 2020
…pping_late()

Commit

  84e6ffb ("arm: add support for folded p4d page tables")

updated create_mapping_late() to take folded P4Ds into account when
creating mappings, but inverted the p4d_alloc() failure test, resulting
in no mapping to be created at all.

When the EFI rtc driver subsequently tries to invoke the EFI GetTime()
service, the memory regions covering the EFI data structures are missing
from the page tables, resulting in a crash like

  Unable to handle kernel paging request at virtual address 5ae0cf28
  pgd = (ptrval)
  [5ae0cf28] *pgd=80000040205003, *pmd=00000000
  Internal error: Oops: 207 [#1] SMP THUMB2
  Modules linked in:
  CPU: 0 PID: 7 Comm: kworker/u32:0 Not tainted 5.7.0+ #92
  Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
  Workqueue: efi_rts_wq efi_call_rts
  PC is at efi_call_rts+0x94/0x294
  LR is at efi_call_rts+0x83/0x294
  pc : [<c0b4f098>]    lr : [<c0b4f087>]    psr: 30000033
  sp : e6219ef0  ip : 00000000  fp : ffffe000
  r10: 00000000  r9 : 00000000  r8 : 30000013
  r7 : e6201dd0  r6 : e6201ddc  r5 : 00000000  r4 : c181f264
  r3 : 5ae0cf10  r2 : 00000001  r1 : e6201dd0  r0 : e6201ddc
  Flags: nzCV  IRQs on  FIQs on  Mode SVC_32  ISA Thumb  Segment none
  Control: 70c5383d  Table: 661cc840  DAC: 00000001
  Process kworker/u32:0 (pid: 7, stack limit = 0x(ptrval))
  ...
  [<c0b4f098>] (efi_call_rts) from [<c0448219>] (process_one_work+0x16d/0x3d8)
  [<c0448219>] (process_one_work) from [<c0448581>] (worker_thread+0xfd/0x408)
  [<c0448581>] (worker_thread) from [<c044ca7b>] (kthread+0x103/0x104)
  ...

Fixes: 84e6ffb ("arm: add support for folded p4d page tables")
Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
@nathanchance
Copy link
Member

nathanchance commented Mar 11, 2021

I believe this has come up again: https://lore.kernel.org/r/8c252429-5000-0649-c49f-8225d911241b@gmail.com/

As I noted in my reply though, it seems Huck's patch does not fix this particular instance but it certainly seems related.

@nickdesaulniers nickdesaulniers added the known difference known difference between GNU and LLVM; maybe unresolvable label Apr 22, 2021
@nickdesaulniers
Copy link
Member Author

@arndb sent a workaround in https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b27aca2e555f87d384cdf60059dd1a1b61c215ef, but we can still repro with that reverted for ARCH=arm allyesconfig if we revert that, so this is still an issue.

@nathanchance
Copy link
Member

Another instance:

https://lore.kernel.org/r/202112181827.o3X7GmHz-lkp@intel.com/

https://godbolt.org/z/srK9cfvPT

$ cat test.c
#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))

static unsigned long long foo = DMA_BIT_MASK(64);

static unsigned long long bar(void)
{
        return DMA_BIT_MASK(64);
}

$ clang -fsyntax-only -Wshift-count-overflow test.c
test.c:3:33: warning: shift count >= width of type [-Wshift-count-overflow]
static unsigned long long foo = DMA_BIT_MASK(64);
                                ^~~~~~~~~~~~~~~~
test.c:1:54: note: expanded from macro 'DMA_BIT_MASK'
#define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
                                                     ^ ~~~
1 warning generated.

@nickdesaulniers
Copy link
Member Author

@nathanchance
Copy link
Member

The Hyper-V patch has been merged into mainline: https://git.kernel.org/linus/6bf625a4140f24b490766043b307f8252519578b

I think that fixing this should be relatively high priority so we do not get bit by this again but we are good for now.

@nathanchance nathanchance added the [WORKAROUND] Applied This bug has an applied workaround label Feb 15, 2022
@nickdesaulniers
Copy link
Member Author

further reduced test case:

unsigned long long foo = 1 ? 0 : 1ULL << 64;

unsigned long long bar (void) {
    return 1 ? 0 : 1ULL << 64;
}

Maybe we can view the CFG to see what looks different between the two.
ClangBuiltLinux/llvm-dev-conf-2020#3 (comment)

https://reviews.llvm.org/D63889 didn't seem fundamentally against the approach, maybe could use a dust off.

@nickdesaulniers nickdesaulniers added [PATCH] Bitrot Patch is outdated and needs to be refreshed or revisited and removed [PATCH] Submitted A patch has been submitted for review labels Sep 10, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
[BUG] llvm A bug that should be fixed in upstream LLVM known difference known difference between GNU and LLVM; maybe unresolvable low priority This bug is not critical and not a priority [PATCH] Bitrot Patch is outdated and needs to be refreshed or revisited [WORKAROUND] Applied This bug has an applied workaround
Projects
None yet
Development

No branches or pull requests

4 participants