Bug Summary

File:src/usr.sbin/bgpd/carp.c
Warning:line 64, column 7
Although the value stored to 'c' is used in the enclosing expression, the value is never actually read from 'c'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name carp.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/bgpd/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/usr.sbin/bgpd -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/bgpd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/usr.sbin/bgpd/carp.c
1/* $OpenBSD: carp.c,v 1.10 2019/08/08 20:06:29 claudio Exp $ */
2
3/*
4 * Copyright (c) 2006 Henning Brauer <henning@openbsd.org>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19#include <sys/types.h>
20#include <sys/socket.h>
21#include <sys/ioctl.h>
22#include <net/if.h>
23
24#include <errno(*__errno()).h>
25#include <string.h>
26#include <stdlib.h>
27#include <unistd.h>
28
29#include "bgpd.h"
30#include "session.h"
31#include "log.h"
32
33struct carpgroup {
34 TAILQ_ENTRY(carpgroup)struct { struct carpgroup *tqe_next; struct carpgroup **tqe_prev
; } entry;
35 char *group;
36 int do_demote;
37 int changed_by;
38};
39
40TAILQ_HEAD(carpgroups, carpgroup)struct carpgroups { struct carpgroup *tqh_first; struct carpgroup
**tqh_last; } carpgroups =
41 TAILQ_HEAD_INITIALIZER(carpgroups){ ((void *)0), &(carpgroups).tqh_first };
42
43struct carpgroup *carp_group_find(char *group);
44int carp_demote_ioctl(char *, int);
45
46struct carpgroup *
47carp_group_find(char *group)
48{
49 struct carpgroup *c;
50
51 TAILQ_FOREACH(c, &carpgroups, entry)for((c) = ((&carpgroups)->tqh_first); (c) != ((void *)
0); (c) = ((c)->entry.tqe_next))
52 if (!strcmp(c->group, group))
53 return (c);
54
55 return (NULL((void *)0));
56}
57
58int
59carp_demote_init(char *group, int force)
60{
61 struct carpgroup *c;
62 int level;
63
64 if ((c = carp_group_find(group)) == NULL((void *)0)) {
Although the value stored to 'c' is used in the enclosing expression, the value is never actually read from 'c'
65 if ((c = calloc(1, sizeof(struct carpgroup))) == NULL((void *)0)) {
66 log_warn("carp_demote_init calloc");
67 return (-1);
68 }
69 if ((c->group = strdup(group)) == NULL((void *)0)) {
70 log_warn("carp_demote_init strdup");
71 free(c);
72 return (-1);
73 }
74
75 /* only demote if this group already is demoted */
76 if ((level = carp_demote_get(group)) == -1) {
77 free(c->group);
78 free(c);
79 return (-1);
80 }
81 if (level > 0 || force)
82 c->do_demote = 1;
83
84 TAILQ_INSERT_TAIL(&carpgroups, c, entry)do { (c)->entry.tqe_next = ((void *)0); (c)->entry.tqe_prev
= (&carpgroups)->tqh_last; *(&carpgroups)->tqh_last
= (c); (&carpgroups)->tqh_last = &(c)->entry.tqe_next
; } while (0);
85 }
86
87 return (0);
88}
89
90void
91carp_demote_shutdown(void)
92{
93 struct carpgroup *c;
94
95 while ((c = TAILQ_FIRST(&carpgroups)((&carpgroups)->tqh_first)) != NULL((void *)0)) {
96 TAILQ_REMOVE(&carpgroups, c, entry)do { if (((c)->entry.tqe_next) != ((void *)0)) (c)->entry
.tqe_next->entry.tqe_prev = (c)->entry.tqe_prev; else (
&carpgroups)->tqh_last = (c)->entry.tqe_prev; *(c)->
entry.tqe_prev = (c)->entry.tqe_next; ; ; } while (0);
97 if (c->do_demote && c->changed_by > 0)
98 carp_demote_ioctl(c->group, -c->changed_by);
99
100 free(c->group);
101 free(c);
102 }
103}
104
105int
106carp_demote_get(char *group)
107{
108 int s;
109 struct ifgroupreq ifgr;
110
111 if ((s = socket(AF_INET2, SOCK_DGRAM2 | SOCK_CLOEXEC0x8000, 0)) == -1) {
112 log_warn("carp_demote_get: socket");
113 return (-1);
114 }
115
116 bzero(&ifgr, sizeof(ifgr));
117 strlcpy(ifgr.ifgr_name, group, sizeof(ifgr.ifgr_name));
118
119 if (ioctl(s, SIOCGIFGATTR(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifgroupreq) & 0x1fff) << 16) | ((('i')) <<
8) | ((139))), (caddr_t)&ifgr) == -1) {
120 if (errno(*__errno()) == ENOENT2)
121 log_warnx("group \"%s\" does not exist", group);
122 else
123 log_warn("carp_demote_get: ioctl");
124 close(s);
125 return (-1);
126 }
127
128 close(s);
129 return ((int)ifgr.ifgr_attribifgr_ifgru.ifgru_attrib.ifg_carp_demoted);
130}
131
132int
133carp_demote_set(char *group, int demote)
134{
135 struct carpgroup *c;
136
137 if ((c = carp_group_find(group)) == NULL((void *)0)) {
138 log_warnx("carp_group_find for %s returned NULL?!", group);
139 return (-1);
140 }
141
142 if (c->changed_by + demote < 0) {
143 log_warnx("carp_demote_set: changed_by + demote < 0");
144 return (-1);
145 }
146
147 if (c->do_demote && carp_demote_ioctl(group, demote) == -1)
148 return (-1);
149
150 c->changed_by += demote;
151
152 /* enable demotion when we return to 0, i. e. all sessions up */
153 if (demote < 0 && c->changed_by == 0)
154 c->do_demote = 1;
155
156 return (0);
157}
158
159int
160carp_demote_ioctl(char *group, int demote)
161{
162 int s, res;
163 struct ifgroupreq ifgr;
164
165 if ((s = socket(AF_INET2, SOCK_DGRAM2 | SOCK_CLOEXEC0x8000, 0)) == -1) {
166 log_warn("%s: socket", __func__);
167 return (-1);
168 }
169
170 bzero(&ifgr, sizeof(ifgr));
171 strlcpy(ifgr.ifgr_name, group, sizeof(ifgr.ifgr_name));
172 ifgr.ifgr_attribifgr_ifgru.ifgru_attrib.ifg_carp_demoted = demote;
173
174 if ((res = ioctl(s, SIOCSIFGATTR((unsigned long)0x80000000 | ((sizeof(struct ifgroupreq) &
0x1fff) << 16) | ((('i')) << 8) | ((140))), (caddr_t)&ifgr)) == -1)
175 log_warn("unable to %s the demote state "
176 "of group '%s'", (demote > 0) ? "increment" : "decrement",
177 group);
178 else
179 log_info("%s the demote state of group '%s'",
180 (demote > 0) ? "incremented" : "decremented", group);
181
182 close(s);
183 return (res);
184}