ClangBuiltLinux / thread-safety-analysis

A research project into applying Clang's Thread Safety Analysis to the Linux Kernel
Other
6 stars 0 forks source link

fs/autofs/waitq.c: validate_request, autofs_wait: cannot annotate due to complex specification #153

Open bulwahn opened 4 years ago

bulwahn commented 4 years ago
fs/autofs/waitq.c:290:8: note: mutex acquired here
                        if (mutex_lock_interruptible(&sbi->wq_mutex))
                            ^
fs/autofs/waitq.c:288:4: warning: releasing mutex 'sbi->wq_mutex' that was not held [-Wthread-safety-analysis]
                        mutex_unlock(&sbi->wq_mutex);
                        ^
fs/autofs/waitq.c:348:1: warning: mutex 'sbi->wq_mutex' is not held on every path through here [-Wthread-safety-analysis]
}
^
fs/autofs/waitq.c:290:8: note: mutex acquired here
                        if (mutex_lock_interruptible(&sbi->wq_mutex))
                            ^
fs/autofs/waitq.c:348:1: warning: mutex 'sbi->wq_mutex' is not held on every path through here [-Wthread-safety-analysis]
}
^
fs/autofs/waitq.c:290:8: note: mutex acquired here
                        if (mutex_lock_interruptible(&sbi->wq_mutex))
                            ^
fs/autofs/waitq.c:416:3: warning: mutex '->wq_mutex' is not held on every path through here [-Wthread-safety-analysis]
                kfree(qstr.name);
                ^
fs/autofs/waitq.c:407:6: note: mutex acquired here
        if (mutex_lock_interruptible(&sbi->wq_mutex)) {
            ^
fs/autofs/waitq.c:482:2: warning: mutex '->wq_mutex' is not held on every path through here [-Wthread-safety-analysis]
        wait_event_killable(wq->queue, wq->name.name == NULL);
        ^
./include/linux/wait.h:873:14: note: expanded from macro 'wait_event_killable'
        int __ret = 0;                                                          \
                    ^
fs/autofs/waitq.c:407:6: note: mutex acquired here
        if (mutex_lock_interruptible(&sbi->wq_mutex)) {
            ^

sbi->wq_mutex is locked and unlocked in various paths and the behaviour in autofs_wait depends on the error code that is returned from validate_request, i.e., if it returns -EINTR.

The analysis cannot handle this.