Bug Summary

File:.build-ci/../shared/pci-util-linux.c
Warning:line 83, column 14
The left operand of '==' is a garbage value

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-redhat-linux-gnu -O3 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name pci-util-linux.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/__w/nvme-cli/nvme-cli/.build-ci -fcoverage-compilation-dir=/__w/nvme-cli/nvme-cli/.build-ci -resource-dir /usr/bin/../lib/clang/22 -include /__w/nvme-cli/nvme-cli/.build-ci/nvme-config.h -I shared/libshared.a.p -I shared -I ../shared -I ccan -I ../ccan -D _FILE_OFFSET_BITS=64 -D _GNU_SOURCE -U NDEBUG -internal-isystem /usr/bin/../lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/bin/../lib/gcc/x86_64-redhat-linux/16/../../../../x86_64-redhat-linux/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -std=gnu11 -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcolor-diagnostics -vectorize-loops -vectorize-slp -analyzer-opt-analyze-headers -analyzer-output=html -faddrsig -fdwarf2-cfi-asm -o /__w/nvme-cli/nvme-cli/.build-ci/scan-results/2026-10-24-125112-639-1 -x c ../shared/pci-util-linux.c
1// SPDX-License-Identifier: LGPL-2.1-or-later
2/*
3 * This file is part of nvme-cli.
4 * Copyright (c) 2026 SUSE LLC
5 *
6 * Authors: Daniel Wagner <dwagner@suse.de>
7 */
8
9#include <errno(*__errno_location ()).h>
10#include <fcntl.h>
11#include <stdio.h>
12#include <unistd.h>
13
14#include "cleanup-util.h"
15#include "pci-util.h"
16
17int shr_pci_open_class_config(const char *dev_class_dir, int flags)
18{
19 __cleanup_free__attribute__((cleanup(shr_freep))) char *config_path = NULL((void*)0);
20 int fd;
21
22 if (asprintf(&config_path, "%s/device/config", dev_class_dir) < 0)
23 return -ENOMEM12;
24
25 fd = open(config_path, flags);
26 if (fd < 0)
27 return -errno(*__errno_location ());
28
29 return fd;
30}
31
32int shr_pci_config_read32(int fd, unsigned int offset, uint32_t *val)
33{
34 unsigned char buf[4];
35 ssize_t n;
36
37 n = pread(fd, buf, sizeof(buf), offset);
38 if (n < 0)
4
←
Assuming 'n' is < 0
→
5
←
Taking true branch
→
39 return -errno(*__errno_location ());
6
←
Returning without writing to '*val'
→
7
←
Returning value, which participates in a condition later
→
40 if (n != (ssize_t)sizeof(buf))
41 return -EIO5;
42
43 *val = (uint32_t)buf[0] | (uint32_t)buf[1] << 8 |
44 (uint32_t)buf[2] << 16 | (uint32_t)buf[3] << 24;
45 return 0;
46}
47
48int shr_pci_config_write32(int fd, unsigned int offset, uint32_t val)
49{
50 unsigned char buf[4] = {
51 val & 0xff, (val >> 8) & 0xff,
52 (val >> 16) & 0xff, (val >> 24) & 0xff,
53 };
54 ssize_t n;
55
56 n = pwrite(fd, buf, sizeof(buf), offset);
57 if (n < 0)
58 return -errno(*__errno_location ());
59 if (n != (ssize_t)sizeof(buf))
60 return -EIO5;
61
62 return 0;
63}
64
65int shr_pci_find_ext_cap(int fd, uint16_t cap_id)
66{
67 unsigned int offset = 0x100;
68 int i, ret;
69
70 /*
71 * The list can't legally hold more entries than there is config
72 * space to hold them in; bound the walk so a malformed or
73 * adversarial header can't turn this into an infinite loop.
74 */
75 for (i = 0; offset
0.1
'offset' is 256
 && i < 256; i++) {
1
Loop condition is true. Entering loop body
→
76 uint32_t header;
2
←
'header' declared without an initial value
→
77
78 ret = shr_pci_config_read32(fd, offset, &header);
3
←
Calling 'shr_pci_config_read32'
→
8
←
Returning from 'shr_pci_config_read32'
→
79 if (ret)
9
←
Assuming 'ret' is 0
→
80 return ret;
81
82 /* An all-zero or all-ones header means nothing is there. */
83 if (header == 0 || header == 0xffffffff)
10
←
The left operand of '==' is a garbage value
84 break;
85
86 if ((header & 0xffff) == cap_id)
87 return (int)offset;
88
89 offset = (header >> 20) & 0xfff;
90 }
91
92 return -ENOENT2;
93}