Bug Summary

File:dev/cardbus/rbus.c
Warning:line 171, column 10
Assigned value is garbage or undefined

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name rbus.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -D CONFIG_DRM_AMD_DC_DCN3_0 -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /usr/obj/sys/arch/amd64/compile/GENERIC.MP/scan-build/2022-01-12-131800-47421-1 -x c /usr/src/sys/dev/cardbus/rbus.c
1/* $OpenBSD: rbus.c,v 1.16 2010/09/22 02:28:37 jsg Exp $ */
2/* $NetBSD: rbus.c,v 1.3 1999/11/06 06:20:53 soren Exp $ */
3/*
4 * Copyright (c) 1999
5 * HAYAKAWA Koichi. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28#include <sys/param.h>
29#include <sys/systm.h>
30#include <sys/device.h>
31#include <sys/malloc.h>
32#include <sys/extent.h>
33
34#include <machine/bus.h>
35
36#include <dev/cardbus/rbus.h>
37
38/* #define RBUS_DEBUG */
39
40#if defined RBUS_DEBUG
41#define STATIC
42#define DPRINTF(a) printf a
43#else
44#ifdef DDB1
45#define STATIC
46#else
47#define STATIC static
48#endif
49#define DPRINTF(a)
50#endif
51
52
53int
54rbus_space_alloc(rbus_tag_t rbt, bus_addr_t addr, bus_size_t size,
55 bus_addr_t mask, bus_addr_t align, int flags, bus_addr_t *addrp,
56 bus_space_handle_t *bshp)
57{
58 return (rbus_space_alloc_subregion(rbt, rbt->rb_start, rbt->rb_end,
59 addr, size, mask, align, flags, addrp, bshp));
60}
61
62int
63rbus_space_alloc_subregion(rbus_tag_t rbt, bus_addr_t substart,
64 bus_addr_t subend, bus_addr_t addr, bus_size_t size,
65 bus_addr_t mask, bus_addr_t align, int flags, bus_addr_t *addrp,
66 bus_space_handle_t *bshp)
67{
68 bus_addr_t decodesize = mask + 1;
69 bus_addr_t boundary, search_addr;
70 int val;
71 u_long result;
72 int exflags = EX_FAST0x0002 | EX_NOWAIT0x0000 | EX_MALLOCOK0x0010;
73
74 DPRINTF(("rbus_space_alloc: addr %lx, size %lx, mask %lx, align %lx\n",
75 (u_long)addr, (u_long)size, (u_long)mask, (u_long)align));
76
77 if (mask == 0) {
78 /* FULL Decode */
79 decodesize = 0;
80 }
81
82 if (rbt->rb_flags == RBUS_SPACE_SHARE0x01 ||
83 rbt->rb_flags == RBUS_SPACE_DEDICATE0x02) {
84 /* rbt has its own sh_extent */
85
86 /* sanity check: the subregion [substart, subend] should be
87 smaller than the region included in sh_extent */
88 if (substart < rbt->rb_ext->ex_start ||
89 subend > rbt->rb_ext->ex_end) {
90 DPRINTF(("rbus: out of range\n"));
91 return (1);
92 }
93
94 if (decodesize == align) {
95 if (extent_alloc_subregion(rbt->rb_ext, substart,
96 subend, size, align, 0, 0, exflags, &result))
97 return (1);
98 } else if (decodesize == 0) {
99 /* maybe, the register is overflowed. */
100
101 if (extent_alloc_subregion(rbt->rb_ext, addr,
102 addr + size, size, 1, 0, 0, exflags, &result))
103 return (1);
104 } else {
105 boundary = decodesize > align ? decodesize : align;
106
107 search_addr = (substart & ~(boundary - 1)) + addr;
108
109 if (search_addr < substart)
110 search_addr += boundary;
111
112 val = 1;
113 for (; search_addr + size <= subend;
114 search_addr += boundary) {
115 val = extent_alloc_subregion(
116 rbt->rb_ext,search_addr,
117 search_addr + size, size, align, 0, 0,
118 exflags, &result);
119 DPRINTF(("rbus: trying [%lx:%lx] %lx\n",
120 (u_long)search_addr,
121 (u_long)search_addr + size,
122 (u_long)align));
123 if (val == 0)
124 break;
125 }
126
127 if (val != 0) {
128 /* no space found */
129 DPRINTF(("rbus: no space found\n"));
130 return (1);
131 }
132 }
133
134 if (md_space_map(rbt, result, size, flags, bshp)_bus_space_map((rbt)->rb_bt, (result), (size), (flags), (bshp
))) {
135 /* map failed */
136 extent_free(rbt->rb_ext, result, size, exflags);
137 return (1);
138 }
139
140 if (addrp != NULL((void *)0))
141 *addrp = result;
142 return (0);
143 } else {
144 /* error!! */
145 DPRINTF(("rbus: no rbus type\n"));
146 return (1);
147 }
148}
149
150int
151rbus_space_free(rbus_tag_t rbt, bus_space_handle_t bsh, bus_size_t size,
152 bus_addr_t *addrp)
153{
154 int exflags = EX_FAST0x0002 | EX_NOWAIT0x0000;
155 bus_addr_t addr;
1
'addr' declared without an initial value
→
156 int status = 1;
157
158 if (rbt->rb_flags == RBUS_SPACE_SHARE0x01 ||
2
←
Assuming field 'rb_flags' is not equal to RBUS_SPACE_SHARE
→
4
←
Taking false branch
→
159 rbt->rb_flags == RBUS_SPACE_DEDICATE0x02) {
3
←
Assuming field 'rb_flags' is not equal to RBUS_SPACE_DEDICATE
→
160 md_space_unmap(rbt, bsh, size, &addr)_bus_space_unmap((rbt)->rb_bt, (bsh), (size), (&addr));
161
162 extent_free(rbt->rb_ext, addr, size, exflags);
163
164 status = 0;
165 } else {
166 /* error. INVALID rbustag */
167 status = 1;
168 }
169
170 if (addrp != NULL((void *)0))
5
←
Assuming 'addrp' is not equal to NULL
→
6
←
Taking true branch
→
171 *addrp = addr;
7
←
Assigned value is garbage or undefined
172
173 return (status);
174}
175
176/*
177 * rbus_tag_t
178 * rbus_new_body(bus_space_tag_t bt,
179 * struct extent *ex, bus_addr_t start, bus_size_t end,
180 * int flags)
181 *
182 */
183rbus_tag_t
184rbus_new_body(bus_space_tag_t bt, struct extent *ex,
185 bus_addr_t start, bus_addr_t end, int flags)
186{
187 rbus_tag_t rb;
188
189 if ((rb = (rbus_tag_t)malloc(sizeof(struct rbustag), M_DEVBUF2,
190 M_NOWAIT0x0002)) == NULL((void *)0)) {
191 panic("no memory for rbus instance");
192 }
193
194 rb->rb_bt = bt;
195 rb->rb_start = start;
196 rb->rb_end = end;
197 rb->rb_flags = flags;
198 rb->rb_ext = ex;
199
200 DPRINTF(("rbus_new_body: [%lx, %lx] type %s name [%s]\n",
201 (u_long)start, (u_long)end,
202 flags == RBUS_SPACE_SHARE ? "share" :
203 flags == RBUS_SPACE_DEDICATE ? "dedicated" : "invalid",
204 ex != NULL ? ex->ex_name : "noname"));
205
206 return (rb);
207}
208
209/*
210 * rbus_tag_t rbus_new_root_delegate(bus_space_tag, bus_addr_t,
211 * bus_size_t)
212 *
213 * This function makes a root rbus instance.
214 */
215rbus_tag_t
216rbus_new_root_delegate(bus_space_tag_t bt, bus_addr_t start, bus_size_t size)
217{
218 rbus_tag_t rb;
219 struct extent *ex;
220
221 if ((ex = extent_create("rbus root", start, start + size, M_DEVBUF2,
222 NULL((void *)0), 0, EX_NOCOALESCE0x0008|EX_NOWAIT0x0000)) == NULL((void *)0))
223 return (NULL((void *)0));
224
225 rb = rbus_new_body(bt, ex, start, start + size,
226 RBUS_SPACE_DEDICATE0x02);
227
228 if (rb == NULL((void *)0))
229 extent_destroy(ex);
230
231 return (rb);
232}
233
234/*
235 * rbus_tag_t rbus_new_root_share(bus_space_tag, struct extent *,
236 * bus_addr_t, bus_size_t)
237 *
238 * This function makes a root rbus instance.
239 */
240rbus_tag_t
241rbus_new_root_share(bus_space_tag_t bt, struct extent *ex, bus_addr_t start,
242 bus_size_t size)
243{
244 /* sanity check */
245 if (start < ex->ex_start || start + size > ex->ex_end) {
246 /* out of range: [start, size] should be contained in
247 * parent space
248 */
249 return (0);
250 /* Should I invoke panic? */
251 }
252
253 return (rbus_new_body(bt, ex, start, start + size,
254 RBUS_SPACE_SHARE0x01));
255}