Skip to content

Fix compiler warnings #1609

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 42 commits into from

Conversation

leonidravich
Copy link

No description provided.

nmorey and others added 30 commits December 13, 2019 08:56
[ Upstream commit a69041a ]

Update testing.md to properly reflect recent changes to the test suite
execution.

Fixes: d6c1c23 ('tests: Fix test locating process')
Signed-off-by: Noa Osherovich <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 381de8c ]

Avoid the following failure when running the tests from CWD of
/usr/share/doc/rdma-core-28.0/tests

[root@rdma-dev-25 tests]$ python3 run_tests.py -v
Traceback (most recent call last):
  File "run_tests.py", line 11, in <module>
    tests = SourceFileLoader('tests', module_path).load_module()
  File "<frozen importlib._bootstrap_external>", line 407, in _check_name_wrapper
  File "<frozen importlib._bootstrap_external>", line 907, in load_module
  File "<frozen importlib._bootstrap_external>", line 732, in load_module
  File "<frozen importlib._bootstrap>", line 265, in _load_module_shim
  File "<frozen importlib._bootstrap>", line 696, in _load
  File "<frozen importlib._bootstrap>", line 677, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 724, in exec_module
  File "<frozen importlib._bootstrap_external>", line 859, in get_code
  File "<frozen importlib._bootstrap_external>", line 916, in get_data
FileNotFoundError: [Errno 2] No such file or directory: '/__init__.py

Fixes: d6c1c23 ("tests: Fix test locating process")
Signed-off-by: Kamal Heib <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 68c6238 ]

After the change to distinguish QP numbers and QP handles, the
cqe->qp field contains the QP handle so as to make lookup for
QPs simple. Flushing CQEs upon destroy of QP needs to be done
by comparing the cqe->qp field with the QP handle, not the QP
number. This change fixes this issue.

Fixes: 3dbaeba  ("vmw_pvrdma: Use resource ids from physical device
if available")
Reviewed-by: Jorgen Hansen <[email protected]>
Reviewed-by: Rajesh Jalisatgi <[email protected]>
Signed-off-by: Bryan Tan <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 0203641 ]

Avoid the following exception when no IB device found by modifying the
ParentDomainTestCase to inherit from RDMATestCase that skip the
test if there is no IB device.

ERROR: test_default_allocators (tests.test_parent_domain.ParentDomainTestCase)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/kheib/git/upstream/rdma-core/tests/test_parent_domain.py", line 35, in setUp
    dev = d.get_device_list()[-1]
IndexError: list index out of range

Fixes: 4fec673 ("tests: Add a test for parent domain")
Signed-off-by: Kamal Heib <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 55654e7 ]

Avoid the following failure by call PyverbsRDMAErrno() with the exact number
of arguments.

Traceback (most recent call last):
  File "/home/rdma-core/tests/test_odp.py", line 56, in test_odp_xrc_traffic
    client, server = self.create_players('xrc')
  File "/home/rdma-core/tests/test_odp.py", line 35, in create_players
    client = self.qp_dict[qp_type](self.dev_name, self.ib_port,
  File "/home/rdma-core/tests/base.py", line 367, in __init__
    super(XRCResources, self).__init__(dev_name, ib_port, gid_index)
  File "/home/rdma-core/tests/base.py", line 238, in __init__
    self.init_resources()
  File "/home/rdma-core/tests/base.py", line 454, in init_resources
    self.create_xrcd()
  File "/home/rdma-core/tests/base.py", line 413, in create_xrcd
    self.xrcd = XRCD(self.ctx, init)
  File "xrcd.pyx", line 54, in pyverbs.xrcd.XRCD.__init__
TypeError: PyverbsRDMAErrno() takes exactly one argument (2 given)

Fixes: b68ce6f ("pyverbs: Introducing XRCD class")
Signed-off-by: Kamal Heib <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit ca2ecc7 ]

CQ has its private error codes, there is no need to use other error codes
in hns_roce_handle_recv_inl_wqe, which will affect the return value of the
poll cq function.

And if the err state is V2_CQ_POLL_ERR, the ci pointer needs to be
updated as the cqe has already been generated.

Fixes: b8bdc87 ("libhns: Optimize some codes for hns userspace")
Fixes: a7d029e ("libhns: Introduce CQ operations referred to hip08 device")
Signed-off-by: Yangyang Li <[email protected]>
Signed-off-by: Weihang Li <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 1260a28 ]

This patch fixes two issues:
1- Avoid iterating out of the range of GIDs table length.
2- Make sure to iterate over the whole GID table as could be holes of
   ZERO_GID.

Fixes: bb59586 ("tests: RDMATestCase")
Signed-off-by: Kamal Heib <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit d04d466 ]

This patch fixes the following Coverity complaint:

CID 1490689 (#1 of 1): Resource leak (RESOURCE_LEAK)
15. leaked_storage: Variable dev going out of scope leaks the storage it points to.

Signed-off-by: Bart Van Assche <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 2da066a ]

Avoid code duplication by move the code of getting the available devices
to a separate function.

Fixes: 8c55be0 ("tests: Skip old tests when no IB devices are found")
Signed-off-by: Kamal Heib <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit fdde742 ]

Commit 26e05f8 ("ibacm: use ccan/list.h") introduced a bug in
acm_get_ep() by not incrementing inx.

Fixes: 26e05f8 ("ibacm: use ccan/list.h")
Signed-off-by: Håkon Bugge <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit a58a5e9 ]

For dual port HCA, which has an InfiniBand port and an Ethernet port,
only open InfiniBand port will introduce segment fault issues.

Because the Ethernet port did not open yet, segment fault when active
the Ethernet port. The second segment fault issue happens when there
is asyn event on the Ethernet port.

We should skip pure iWARP or RoCE devices, but not device which has at
least one InfiniBand port.

This patch also reverts commits d04d466 and e9ffc0b.

d04d466 ("ibacm: Fix a memory leak in an acm_open_dev() error path")
e9ffc0b ("ibacm: only open InfiniBand port")

Fixes: e9ffc0b ("ibacm: only open InfiniBand port")
Signed-off-by: Honggang Li <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit b2b870c ]

In some devices, the page_size_cap is equal to PAGE_SIZE.

Fixes: 9d66a1a ("pyverbs: Add support for extended query_device")
Signed-off-by: Kamal Heib <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 256f045 ]

The multi-function devices have same system image GUID while presented
with multiple IB devices. This leads to the failures for NAME_GUID
option to rename second device. Instead of system image GUID use
node GUID as a unique identifier.

Cc: <[email protected]>
Fixes: 6b4099d ("kernel-boot: Perform device rename to make stable names")
Signed-off-by: Leon Romanovsky <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 323709b ]

In traffic() helper method, do post_recv after a recv WQE was consumed
by the hardware.

Fixes: 6fb2b9b ('tests: Add traffic helper methods')
Signed-off-by: Noa Osherovich <[email protected]>
Reviewed-by: Edward Srouji <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit d8a052e ]

qp->sq.lock is currently unlocked twice when the ring state is invalid.
Fix this by removing the goto, and also set bad_wr correctly.

Fixes: 36756a6 ("libpvrdma: Add queue pair functions")
Cc: [email protected]
Reviewed-by: Vishnu Dasa <[email protected]>
Reviewed-by: Adit Ranadive <[email protected]>
Reviewed-by: Rajesh Jalisatgi <[email protected]>
Signed-off-by: Bryan Tan <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 366374e ]

The state of ibvqp will be updated after calling modify_qp(), because the
assignment of ibvqp->state is out of hns driver, it can't be guaranteed
that the configuration of ibvqp->state will take effect immediately. This
may cause hns_roce_u_v2_modify_qp() in post_send/post_recv process is
skipped.

Therefore, update value of ibvqp->state in modify_qp().

Fixes: f1a80cc ("libhns: Bugfix for flush cqe in case multi-process")
Signed-off-by: Yangyang Li <[email protected]>
Signed-off-by: Lijun Ou <[email protected]>
Signed-off-by: Weihang Li <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 9bb0fcf ]

The user context alloc request structure introduced a new field
to indicate doorbell recovery is supported. This field was added so
that additional features could be added in the future by setting a
capability flag. However, the field wasn't zeroed, and was initialized
using "|=" instead of "=" leading to garbage in the other bits.
For forward compatability, we need to make sure all other bits are
zero.

Cc: [email protected] # v27 v28
Fixes: d9b2ba4 ("libqedr: Add support for Doorbell Overflow Recovery")
Signed-off-by: Ariel Elior <[email protected]>
Signed-off-by: Michal Kalderon <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 7c3d2fa ]

PyverbsRDMAErrno takes only a message as argument, and it automatically
raises PyverbsRDMAError with an updated message that includes the errno.

Fixes: 7572aa1 ("pyverbs: Introducing pyverbs and its context class")
Signed-off-by: Edward Srouji <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit e3077b7 ]

l[port_state] in the port_state_to_str function returns an str, this
commit removes .name from l[port_state].name.

Fixes: a316351 ("pyverbs: Changes to print-related functions")
Signed-off-by: Amit Matityahu <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 9768181 ]

CHECK_AND_SET_VAL((p->qos_class << 4), 16, -1, qos_class, PR, QOS_CLASS);

This Macro is expanded as following lines:

if ((int16_t) (p->qos_class << 4) != (int16_t) -1) {
	qos_class = htobe16((uint16_t) (p->qos_class << 4));
	comp_mask |= IB_PR_COMPMASK_QOS_CLASS;
};

Error: CONSTANT_EXPRESSION_RESULT (CWE-569):
rdma-core-28.0/infiniband-diags/saquery.c:1062: result_independent_of_operands: "(int16_t)(p->qos_class << 4) != -1 /* (int16_t)-1 */" is always true regardless of the values of its operands. This occurs as the logical operand of "if".
|# 1060|     CHECK_AND_SET_VAL(p->pkey, 16, 0, pr.pkey, PR, PKEY);
|# 1061|     CHECK_AND_SET_VAL(p->sl, 16, -1, pr.qos_class_sl, PR, SL);
|# 1062|->   CHECK_AND_SET_VAL((p->qos_class << 4), 16, -1, qos_class, PR, QOS_CLASS);
|# 1063|     pr.qos_class_sl = (pr.qos_class_sl & htobe16(IB_PATH_REC_SL_MASK)) |
|# 1064|               qos_class;

Fixes: 0005d2a ("saquery.c: Fix changing qos_class flag value to network order twice")
Signed-off-by: Honggang Li <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 45be555 ]

The TX Low Latency Queue (LLQ) is stored on the device's BAR, hence
mmio_flush_writes should be used instead of udma_to_device_barrier
before ringing the doorbell.

mmio_wc_spinlock is used when acquiring the lock in order to guarantee
that prior mmio writes are ordered with regard to the WC memory writes
inside the lock.
However, mmio_wc_spinunlock isn't used as the doorbell write must be
done while holding the spinlock.

Fixes: f7f275f ("efa: Elastic Fabric Adapter (EFA) userspace RDMA provider")
Fixes: f189a2a ("efa: Support send using extended QP API")
Signed-off-by: Gal Pressman <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit f026ac0 ]

Compare CA device names by using the maximum length between them in order
to avoid matches of sub strings between CA device names that can match
the wrong device.

Example before the fix:
Input CA name: abc_11
List CA names: abc_1, def_1
When running : ibstat abc_11, the output will be the details of abc_1 even
though abc_11 does not exist.

After the fix, the output of this case will be:
'abc_11' IB device can't be found

Signed-off-by: Haim Boozaglo <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 482eb44 ]

When a firmware reset occurred because of some errors, modify qp to error
in post_send() will be failed. The bad_wr will be returned to the user,
then the user won't wait for the corresponding wc. But as sq db has been
updated, the driver will return a software wc to the user, which may cause
unexpected behaviours.

Because the result of modifying qp is meaningless in this scenario, codes
to handle the return value are removed.

Signed-off-by: Yangyang Li <[email protected]>
Signed-off-by: Jiaran Zhang <[email protected]>
Signed-off-by: Weihang Li <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 85e410d ]

Signed-off-by: Honggang Li <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 2b25ddd ]

Error: UNUSED_VALUE (CWE-563):
rdma-core-28.0/librdmacm/examples/rcopy.c:265: value_overwrite: Overwriting previous write to "ret" with value "0".
rdma-core-28.0/librdmacm/examples/rcopy.c:262: assigned_value: Assigning value from "*__errno_location()" to "ret" here, but that stored value is overwritten before it can be used.
|#  260|     if (fd < 0) {
|#  261|         printf("unable to open destination file\n");
|#  262|->       ret = errno;
|#  263|     }
|#  264|

Signed-off-by: Honggang Li <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 4a0245e ]

Error: CPPCHECK_WARNING:
rdma-core-28.0/infiniband-diags/ibportstate.c:245: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
|#  243|     mod = portnum;
|#  244|     if (espeed_cap)
|#  245|->       mod |= 1<<31;
|#  246|     if (!smp_set_via(data, dest, IB_ATTR_PORT_INFO, mod, 0, srcport))
|#  247|         IBEXIT("smp set portinfo failed");

Signed-off-by: Honggang Li <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 00dba86 ]

Error: CHECKED_RETURN (CWE-252):
rdma-core-28.0/srp_daemon/srp_daemon.c:2164: check_return: Calling "umad_init" without checking return value (as is done elsewhere 8 out of 10 times).
rdma-core-28.0/ibacm/src/acm.c:3331: example_checked: Example 1: "umad_init()" has its value checked in "umad_init() != 0".
rdma-core-28.0/infiniband-diags/ibstat.c:305: example_checked: Example 2: "umad_init()" has its value checked in "umad_init() < 0".
rdma-core-28.0/infiniband-diags/saquery.c:1855: example_checked: Example 3: "umad_init()" has its value checked in "umad_init()".
rdma-core-28.0/infiniband-diags/smpdump.c:217: example_checked: Example 4: "umad_init()" has its value checked in "umad_init() < 0".
rdma-core-28.0/libibmad/rpc.c:385: example_checked: Example 5: "umad_init()" has its value checked in "umad_init() < 0".
|# 2162|     }
|# 2163|
|# 2164|->   umad_init();
|# 2165|     res = alloc_res();
|# 2166|     if (!res) {

Signed-off-by: Honggang Li <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 5f2099e ]

Dump only supported port extended counters instead of dump
all extedned port counters that some of them may be not supported
and dumped with zero values.

When IsExtendedWidthSupported detected, the following fields will be
dumped:
PortUnicastXmitPkts
PortUnicastRcvPkts
PortMulticastXmitPkts
PortMulticastRcvPkts

When IsAdditionalPortCountersExtendedSupported detected, the following
fields will be dumped:
CounterSelect2
SymbolErrorCounter
LinkErrorRecoveryCounter
LinkDownedCounter
PortRcvErrors
PortRcvRemotePhysicalErrors
PortRcvSwitchRelayErrors
PortXmitDiscards
PortXmitConstraintErrors
PortRcvConstraintErrors
LocalLinkIntegrityErrors
ExcessiveBufferOverrunErrors
VL15Dropped
PortXmitWait
QP1Dropped

Signed-off-by: Haim Boozaglo <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 5c80749 ]

Error: CPPCHECK_WARNING (CWE-120): [#def33]
rdma-core-28.0/infiniband-diags/ibtracert.c:935: error[invalidScanfFormatWidth]: Width 20 given in format string (no. 1) is larger than destination buffer 'srcbuf[20]', use %19s to prevent overflowing it.
|#  933|   				continue;	/* ignore comment lines */
|#  934|
|#  935|-> 			if (sscanf(portsbuf, "%20s %20s", srcbuf, dstbuf) != 2)
|#  936|   				IBEXIT("ports-file, %s, at line %i contains bad data",
|#  937|   					ports_file, line_count);

Error: CPPCHECK_WARNING (CWE-120): [#def34]
rdma-core-28.0/infiniband-diags/ibtracert.c:935: error[invalidScanfFormatWidth]: Width 20 given in format string (no. 2) is larger than destination buffer 'dstbuf[20]', use %19s to prevent overflowing it.
|#  933|   				continue;	/* ignore comment lines */
|#  934|
|#  935|-> 			if (sscanf(portsbuf, "%20s %20s", srcbuf, dstbuf) != 2)
|#  936|   				IBEXIT("ports-file, %s, at line %i contains bad data",
|#  937|   					ports_file, line_count);

Signed-off-by: Honggang Li <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
Honggang-LI and others added 12 commits March 3, 2020 10:15
[ Upstream commit d034e23 ]

Error: RESOURCE_LEAK (CWE-772): [#def38]
rdma-core-28.0/infiniband-diags/ibdiag_common.c:167: alloc_fn: Storage is returned from allocation function "strdup".
rdma-core-28.0/infiniband-diags/ibdiag_common.c:167: var_assign: Assigning: "ibd_nd_format" = storage returned from "strdup(val_str)".
rdma-core-28.0/infiniband-diags/ibdiag_common.c:167: overwrite_var: Overwriting "ibd_nd_format" in "ibd_nd_format = strdup(val_str)" leaks the storage that "ibd_nd_format" points to.
|#  165|   		} else if (strncmp(name, "nd_format",
|#  166|   				   strlen("nd_format")) == 0) {
|#  167|-> 			ibd_nd_format = strdup(val_str);
|#  168|   		}
|#  169|   	}

Signed-off-by: Honggang Li <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 5072f22 ]

Error: RESOURCE_LEAK (CWE-772): [#def40]
rdma-core-28.0/infiniband-diags/ibroute.c:176: alloc_fn: Storage is returned from allocation function "remap_node_name".
rdma-core-28.0/infiniband-diags/ibroute.c:176: var_assign: Assigning: "mapnd" = storage returned from "remap_node_name(node_name_map, nodeguid, nd)".
rdma-core-28.0/infiniband-diags/ibroute.c:178: noescape: Resource "mapnd" is not freed or pointed-to in "printf".
rdma-core-28.0/infiniband-diags/ibroute.c:220: leaked_storage: Variable "mapnd" going out of scope leaks the storage it points to.
|#  218|   						"; MAD status 0x%x AM 0x%x\n",
|#  219|   						status, mod);
|#  220|-> 				return NULL;
|#  221|   			}
|#  222|   		}

Error: RESOURCE_LEAK (CWE-772): [#def41]
rdma-core-28.0/infiniband-diags/ibroute.c:348: alloc_fn: Storage is returned from allocation function "remap_node_name".
rdma-core-28.0/infiniband-diags/ibroute.c:348: var_assign: Assigning: "mapnd" = storage returned from "remap_node_name(node_name_map, nodeguid, nd)".
rdma-core-28.0/infiniband-diags/ibroute.c:350: noescape: Resource "mapnd" is not freed or pointed-to in "printf".
rdma-core-28.0/infiniband-diags/ibroute.c:368: leaked_storage: Variable "mapnd" going out of scope leaks the storage it points to.
|#  366|   					"; MAD status 0x%x AM 0x%x\n",
|#  367|   					status, block);
|#  368|-> 			return NULL;
|#  369|   		}
|#  370|   		i = block * IB_SMP_DATA_SIZE;
Signed-off-by: Honggang Li <[email protected]>

Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit bb64369 ]

Error: RESOURCE_LEAK (CWE-772): [#def48]
rdma-core-28.0/infiniband-diags/mcm_rereg_test.c:322: alloc_fn: Storage is returned from allocation function "calloc".
rdma-core-28.0/infiniband-diags/mcm_rereg_test.c:322: var_assign: Assigning: "list" = storage returned from "calloc(50UL, 32UL)".
rdma-core-28.0/infiniband-diags/mcm_rereg_test.c:332: leaked_storage: Variable "list" going out of scope leaks the storage it points to.
|#  330|   	if (!f) {
|#  331|   		err("cannot open %s: %s\n", guid_file, strerror(errno));
|#  332|-> 		return -1;
|#  333|   	}
|#  334|

Signed-off-by: Honggang Li <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit c2ae19d ]

Error: DC.STREAM_BUFFER (CWE-120): [#def50]
rdma-core-28.0/kernel-boot/rdma_rename.c:171: dont_call: "fscanf" assumes an arbitrarily long string, so callers must use correct precision specifiers or never use "fscanf".
rdma-core-28.0/kernel-boot/rdma_rename.c:171: remediation: Use correct precision specifiers or implement your own parsing.
|#  169|   		}
|#  170|
|#  171|-> 		ret = fscanf(fp, "%s", address);
|#  172|   		fclose(fp);
|#  173|

Signed-off-by: Honggang Li <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 8f3ce6f ]

Error: USE_AFTER_FREE (CWE-416): [#def59]
rdma-core-28.0/providers/qedr/qelr_verbs.c:194: freed_arg: "free" frees "vmr".
rdma-core-28.0/providers/qedr/qelr_verbs.c:196: pass_freed_arg: Passing freed pointer "vmr" as an argument to "fprintf".
|#  194|   	free(vmr);
|#  195|
|#  196|-> 	DP_VERBOSE(cxt->dbg_fp, QELR_MSG_MR,
|#  197|   		   "MR DERegister %p completed successfully\n", vmr);
|#  198|   	return 0;

Error: USE_AFTER_FREE (CWE-416): [#def60]
rdma-core-28.0/providers/qedr/qelr_verbs.c:324: freed_arg: "free" frees "cq".
rdma-core-28.0/providers/qedr/qelr_verbs.c:326: pass_freed_arg: Passing freed pointer "cq" as an argument to "fprintf".
|#  324|   	free(cq);
|#  325|
|#  326|-> 	DP_VERBOSE(cxt->dbg_fp, QELR_MSG_CQ,
|#  327|   		   "destroy cq: successfully destroyed %p\n", cq);
|#  328|

Error: USE_AFTER_FREE (CWE-416): [#def61]
rdma-core-28.0/providers/qedr/qelr_verbs.c:1059: freed_arg: "free" frees "qp".
rdma-core-28.0/providers/qedr/qelr_verbs.c:1061: pass_freed_arg: Passing freed pointer "qp" as an argument to "fprintf".
|# 1059|   	free(qp);
|# 1060|
|# 1061|-> 	DP_VERBOSE(cxt->dbg_fp, QELR_MSG_QP,
|# 1062|   		   "destroy cq: successfully destroyed %p\n", qp);
|# 1063|

Signed-off-by: Honggang Li <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit a35be3d ]

Adapt the send info write length to the dynamic number of actions.

Before changing the actions number to be dynamic the length matched to
the chunk capacity.
Post moving to support the dynamic mode the real length should be used
to prevent copying from smaller data buffer a larger chunk capacity
which might lead to a segmentation fault.

Fixes: 9d18743 ("mlx5: Extended modify header to support more than 8 modify actions")
Signed-off-by: Hamdan Igbaria <[email protected]>
Signed-off-by: Alex Vesker <[email protected]>
Signed-off-by: Yishai Hadas <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 671b3e1 ]

Error: RESOURCE_LEAK (CWE-772):
rdma-core-29.0/libibverbs/examples/xsrq_pingpong.c:581: open_fn: Returning handle opened by "socket". [Note: The source code implementation of the function has been overridden by a builtin model.]
rdma-core-29.0/libibverbs/examples/xsrq_pingpong.c:581: var_assign: Assigning: "sockfd" = handle returned from "socket(t->ai_family, t->ai_socktype, t->ai_protocol)".
rdma-core-29.0/libibverbs/examples/xsrq_pingpong.c:583: noescape: Resource "sockfd" is not freed or pointed-to in "connect". [Note: The source code implementation of the function has been overridden by a builtin model.]
rdma-core-29.0/libibverbs/examples/xsrq_pingpong.c:598: noescape: Resource "sockfd" is not freed or pointed-to in "send_local_dest".
rdma-core-29.0/libibverbs/examples/xsrq_pingpong.c:599: leaked_handle: Handle variable "sockfd" going out of scope leaks the handle.
|#  597|
|#  598|   	if (send_local_dest(sockfd, 0))
|#  599|-> 		return 1;
|#  600|
|#  601|   	if (recv_remote_dest(sockfd, 0))

Signed-off-by: Honggang Li <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 5c9647a ]

Error: RESOURCE_LEAK (CWE-772):
rdma-core-29.0/librdmacm/examples/rstream.c:410: alloc_arg: "getaddrinfo" allocates memory that is stored into "ai".
rdma-core-29.0/librdmacm/examples/rstream.c:428: leaked_storage: Variable "ai" going out of scope leaks the storage it points to.
|#  426|   		if (ret) {
|#  427|   			printf("getaddrinfo src_addr: %s\n", gai_strerror(ret));
|#  428|-> 			return ret;
|#  429|   		}
|#  430|   	}

Error: RESOURCE_LEAK (CWE-772):
rdma-core-29.0/librdmacm/examples/rstream.c:424: alloc_arg: "getaddrinfo" allocates memory that is stored into "ai_src".
rdma-core-29.0/librdmacm/examples/rstream.c:494: leaked_storage: Variable "ai_src" going out of scope leaks the storage it points to.
|#  492|   	else
|#  493|   		freeaddrinfo(ai);
|#  494|-> 	return ret;
|#  495|   }
|#  496|
Signed-off-by: Honggang Li <[email protected]>

Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 271b019 ]

Error: RESOURCE_LEAK (CWE-772):
rdma-core-29.0/iwpmd/iwarp_pm_helper.c:407: open_arg: "get_iwpm_tcp_port" opens handle stored into "new_sd".
rdma-core-29.0/iwpmd/iwarp_pm_helper.c:416: leaked_handle: Handle variable "new_sd" going out of scope leaks the handle.
|#  414|   	iwpm_debug(IWARP_PM_ALL_DBG, "reopen_iwpm_mapped_port: Could not make port mapping (%s).\n",
|#  415|   			str_err);
|#  416|-> 	return NULL;
|#  417|   }
|#  418|
Signed-off-by: Honggang Li <[email protected]>

Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
[ Upstream commit 271b019 ]

Error: RESOURCE_LEAK (CWE-772):
rdma-core-29.0/iwpmd/iwarp_pm_helper.c:407: open_arg: "get_iwpm_tcp_port" opens handle stored into "new_sd".
rdma-core-29.0/iwpmd/iwarp_pm_helper.c:416: leaked_handle: Handle variable "new_sd" going out of scope leaks the handle.
|#  414|   	iwpm_debug(IWARP_PM_ALL_DBG, "reopen_iwpm_mapped_port: Could not make port mapping (%s).\n",
|#  415|   			str_err);
|#  416|-> 	return NULL;
|#  417|   }
|#  418|
Signed-off-by: Honggang Li <[email protected]>

Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
Signed-off-by: Nicolas Morey-Chaisemartin <[email protected]>
This change addresses several compiler warnings identified during a code review:

1.  **Uninitialized Variables:**
    *   In `providers/cxgb4/cq.c` (c4iw_poll_cq_one): Initialized `union t4_cqe cqe` to {0}. This resolves a warning about potential use of an uninitialized variable.
    *   In `providers/mthca/qp.c` (mthca_tavor_post_send & mthca_arbel_post_send): Initialized `uint32_t f0` and `uint32_t op0` to 0. These variables are used to store properties of the first work request in a batch for doorbell ringing; while logic generally ensures they are set, explicit initialization prevents warnings and potential issues with obscure code paths.

2.  **Missing Function Prototype:**
    *   In `librdmacm/preload.c`: Added a forward declaration for `int __fxstat(int ver, int fd, struct stat *buf);`. This resolves a `-Wmissing-prototypes` warning and ensures the compiler is aware of the function's signature.

**Other Review Findings (Not Addressed in this Commit):**

*   **Array Subscript Out of Bounds (False Positives):** Warnings in `ibacm/src/acm.c` and `ibacm/prov/acmp/src/acmp.c` related to zero-length arrays were assessed as likely false positives, as the code uses the flexible array member idiom correctly.
*   **Deprecated `pthread_yield`:** Usage in `librdmacm/rsocket.c` was noted.
*   **Mismatched Array Parameter Bounds:** Warnings in `libibumad/umad.c` and `libibmad/register.c` were assessed as likely benign due to API design.

These changes enhance code safety and silence distracting compiler warnings.
@jgunthorpe
Copy link
Member

What is this? It is badly formed

@rleon rleon closed this Jun 5, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.