Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Ran Wang <ran.wang_1@nxp.com>
To:     Dan Carpenter <dan.carpenter@oracle.com>,
        "kbuild@lists.01.org" <kbuild@lists.01.org>
CC:     "lkp@intel.com" <lkp@intel.com>,
        "kbuild-all@lists.01.org" <kbuild-all@lists.01.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Felipe Balbi <felipe.balbi@linux.intel.com>,
        Peter Chen <peter.chen@nxp.com>
Subject: RE: [kbuild] drivers/usb/gadget/udc/fsl_udc_core.c:1055
 fsl_ep_fifo_status() error: we previously assumed '_ep->desc' could be null
 (see line 1055)
Thread-Topic: [kbuild] drivers/usb/gadget/udc/fsl_udc_core.c:1055
 fsl_ep_fifo_status() error: we previously assumed '_ep->desc' could be null
 (see line 1055)
Thread-Index: AQHWSMHg173I/CwxlUSjT6yCmaAgyajldNlA
Date:   Tue, 23 Jun 2020 02:22:18 +0000
Message-ID: <AM6PR04MB54138B87957CFB06EC9DF351F1940@AM6PR04MB5413.eurprd04.prod.outlook.com>
References: <20200622182023.GX4282@kadam>
In-Reply-To: <20200622182023.GX4282@kadam>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 5298aca8-683a-4620-04d2-08d8171c40f8
X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Jun 2020 02:22:18.8075
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 7wh1/IyLkAiSrzPaCPq8xQVwuN6xI/alAKUC2CKKgHI81SsVaibWetW6DGsssMKNcdEwva/FwdpbBgbMqG/vWg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR04MB4886
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Dan

On Tuesday, June 23, 2020 2:20 AM, Dan Carpenter wrote:

<snip>

>=20
> If you fix the issue, kindly add following tag as appropriate
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>=20
> New smatch warnings:
> drivers/usb/gadget/udc/fsl_udc_core.c:1055 fsl_ep_fifo_status() error: we
> previously assumed '_ep->desc' could be null (see line 1055)
>=20

<snip>

>=20
> 2ea6698d7b9266 drivers/usb/gadget/fsl_udc_core.c     Anatolij Gustschin
> 2011-04-18  1047  static int fsl_ep_fifo_status(struct usb_ep *_ep)
> 2ea6698d7b9266 drivers/usb/gadget/fsl_udc_core.c     Anatolij Gustschin
> 2011-04-18  1048  {
> 2ea6698d7b9266 drivers/usb/gadget/fsl_udc_core.c     Anatolij Gustschin
> 2011-04-18  1049  	struct fsl_ep *ep;
> 2ea6698d7b9266 drivers/usb/gadget/fsl_udc_core.c     Anatolij Gustschin
> 2011-04-18  1050  	struct fsl_udc *udc;
> 2ea6698d7b9266 drivers/usb/gadget/fsl_udc_core.c     Anatolij Gustschin
> 2011-04-18  1051  	int size =3D 0;
> 2ea6698d7b9266 drivers/usb/gadget/fsl_udc_core.c     Anatolij Gustschin
> 2011-04-18  1052  	u32 bitmask;
> 6414e94c203d92 drivers/usb/gadget/fsl_udc_core.c     Li Yang
> 2011-11-23  1053  	struct ep_queue_head *qh;
> 2ea6698d7b9266 drivers/usb/gadget/fsl_udc_core.c     Anatolij Gustschin
> 2011-04-18  1054
> 75eaa498c99eeb drivers/usb/gadget/udc/fsl_udc_core.c Nikhil Badola
> 2019-10-21 @1055  	if (!_ep || _ep->desc || !(_ep->desc->bEndpointAddress=
&0xF))
>                                          ^^^^^^^^^ Reversed NULL test.  T=
his will always return -ENODEV.  (Or possibly crash.  But I suspect it alwa=
ys returns -ENODEV instead of crashing).

So the kernel test reports warning in case of '_ep->desc is null', right?=20

My understanding is that this judgement would return -ENODEV when
executing '... || _ep-desc ||..' and never execute '_ep->desc->bEndpointAdd=
ress' part,
so crash would not happen, am I right?

> The container_of() macro doesn't dereference anything, btw.  It just does
> pointer math.  I think it would be cleaner to use ep_index() like the ori=
ginal
> code did.  In other words, perhaps it would look best written like this:

Yes, I agree using ep_index() would be easier for reading, just feel a litt=
le bit
uncomfortable to mix checking on _ep and it's container (ep) in the same li=
ne.

> 	ep =3D container_of(_ep, struct fsl_ep, ep);
> 	if (!_ep || !_ep->desc || ep_index(ep) =3D=3D 0)
>=20
>=20

BTW, Nikhil Badola has left NXP (Freesale), so his email address is invalid=
 now.

Thanks & Regards,
Ran