xfsprogs: use abort() not ASSERT(0) for impossible switch case

PATCH In review Eric Sandeen 3 participants 6 messages Aug 21, 2014

Share & tools

Eric Sandeen

author

2014-08-21 17:32 UTC #0 lore raw

PATCH 1/1 xfsprogs: use abort() not ASSERT(0) for impossible switch case

The original reason for the expletive below has been lost in the mists of time, but at any rate, ASSERT() goes away in libxfs, and this leads static analysis checkers to believe that XFS_BTNUM_MAX is possible, and that we might overflow an array later when using it as an index.

We can shut this up and mark it as truly impossible with abort().

Signed-off-by Eric Sandeen <[email protected]>

---

include/xfs_btree.h +2 -2

index 2590d40..f4a1f61 100644
@@ -69,7 +69,7 @@ do {    \
 	case XFS_BTNUM_BMAP: __XFS_BTREE_STATS_INC(bmbt, stat); break;	\
 	case XFS_BTNUM_INO: __XFS_BTREE_STATS_INC(ibt, stat); break;	\
 	case XFS_BTNUM_FINO: __XFS_BTREE_STATS_INC(fibt, stat); break;	\
-	case XFS_BTNUM_MAX: ASSERT(0); /* fucking gcc */ ; break;	\
+	case XFS_BTNUM_MAX: abort(); /* fucking gcc */ ; break;	\
 	}       \
 } while (0)

@@ -83,7 +83,7 @@ do {    \
 	case XFS_BTNUM_BMAP: __XFS_BTREE_STATS_ADD(bmbt, stat, val); break; \
 	case XFS_BTNUM_INO: __XFS_BTREE_STATS_ADD(ibt, stat, val); break; \
 	case XFS_BTNUM_FINO: __XFS_BTREE_STATS_ADD(fibt, stat, val); break; \
-	case XFS_BTNUM_MAX: ASSERT(0); /* fucking gcc */ ; break;	\
+	case XFS_BTNUM_MAX: abort(); /* fucking gcc */ ; break;	\
 	}       \
 } while (0)

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs

Christoph Hellwig

2014-08-21 17:44 UTC #1 lore raw

Quoted 7 lines · Eric Sandeen

The original reason for the expletive below has been lost in the mists of time, but at any rate, ASSERT() goes away in libxfs, and this leads static analysis checkers to believe that XFS_BTNUM_MAX is possible, and that we might overflow an array later when using it as an index.
We can shut this up and mark it as truly impossible with abort().

This won't work in kernel space, and we'd like to keep this file in sync.

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs

Eric Sandeen

author

2014-08-21 17:45 UTC #2 lore raw

Quoted 10 lines · Christoph Hellwig

Quoted 7 lines · Eric Sandeen
The original reason for the expletive below has been lost in the mists of time, but at any rate, ASSERT() goes away in libxfs, and this leads static analysis checkers to believe that XFS_BTNUM_MAX is possible, and that we might overflow an array later when using it as an index.
We can shut this up and mark it as truly impossible with abort().
This won't work in kernel space, and we'd like to keep this file in sync.

Ah, right, sorry - spaced out that it was shared.

I'll add ASSERT_ALWAYS() to userspace then, perhaps.

Thanks,
-Eric

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs

Eric Sandeen

author

2014-08-21 18:27 UTC #3 lore raw

PATCH v2 1/1 xfsprogs: use ASSERT_ALWAYS for impossible switch case

In reply to Eric Sandeen

We can shut this up and mark it as truly impossible by adding a userspace definition for ASSERT_ALWAYS and using it.

Signed-off-by Eric Sandeen <[email protected]>

---

V2: do it in a kernel-compatible way.

include/xfs_btree.h +2 -2

index 2590d40..f24f787 100644
@@ -69,7 +69,7 @@ do {    \
 	case XFS_BTNUM_BMAP: __XFS_BTREE_STATS_INC(bmbt, stat); break;	\
 	case XFS_BTNUM_INO: __XFS_BTREE_STATS_INC(ibt, stat); break;	\
 	case XFS_BTNUM_FINO: __XFS_BTREE_STATS_INC(fibt, stat); break;	\
-	case XFS_BTNUM_MAX: ASSERT(0); /* fucking gcc */ ; break;	\
+	case XFS_BTNUM_MAX: ASSERT_ALWAYS(0); /* fucking gcc */ ; break; \
 	}       \
 } while (0)

@@ -83,7 +83,7 @@ do {    \
 	case XFS_BTNUM_BMAP: __XFS_BTREE_STATS_ADD(bmbt, stat, val); break; \
 	case XFS_BTNUM_INO: __XFS_BTREE_STATS_ADD(ibt, stat, val); break; \
 	case XFS_BTNUM_FINO: __XFS_BTREE_STATS_ADD(fibt, stat, val); break; \
-	case XFS_BTNUM_MAX: ASSERT(0); /* fucking gcc */ ; break;	\
+	case XFS_BTNUM_MAX: ASSERT_ALWAYS(0); /* fucking gcc */ ; break; \
 	}       \
 } while (0)

libxfs/xfs.h +4 -0

index 30a316d..81d7cd9 100644
@@ -48,6 +48,10 @@
 #undef ASSERT
 #define ASSERT(ex) assert(ex)
 
+#undef ASSERT_ALWAYS
+#define ASSERT_ALWAYS(ex) \
+	(unlikely(ex) ? (void)0 : abort())
+
 typedef __uint32_t		uint_t;
 typedef __uint32_t		inst_t;		/* an instruction */

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs

Dave Chinner

2014-08-21 22:55 UTC #4 lore raw

Re: [PATCH V2] xfsprogs: use ASSERT_ALWAYS for impossible switch case

Quoted 28 lines · Eric Sandeen

The original reason for the expletive below has been lost in the mists of time, but at any rate, ASSERT() goes away in libxfs, and this leads static analysis checkers to believe that XFS_BTNUM_MAX is possible, and that we might overflow an array later when using it as an index.
We can shut this up and mark it as truly impossible by adding a userspace definition for ASSERT_ALWAYS and using it.
Signed-off-by Eric Sandeen <[email protected]>
---
V2: do it in a kernel-compatible way.
include/xfs_btree.h +1 -1
index 2590d40..f24f787 100644
@@ -69,7 +69,7 @@ do {    \
 	case XFS_BTNUM_BMAP: __XFS_BTREE_STATS_INC(bmbt, stat); break;	\
 	case XFS_BTNUM_INO: __XFS_BTREE_STATS_INC(ibt, stat); break;	\
 	case XFS_BTNUM_FINO: __XFS_BTREE_STATS_INC(fibt, stat); break;	\
-	case XFS_BTNUM_MAX: ASSERT(0); /* fucking gcc */ ; break;	\
+	case XFS_BTNUM_MAX: ASSERT_ALWAYS(0); /* fucking gcc */ ; break; \
 	}       \
 } while (0)
 

include/xfs_btree.h do { \ · line 88

Quoted 7 lines

include/xfs_btree.h +1 -1

@@ -83,7 +83,7 @@ do {    \
 	case XFS_BTNUM_BMAP: __XFS_BTREE_STATS_ADD(bmbt, stat, val); break; \
 	case XFS_BTNUM_INO: __XFS_BTREE_STATS_ADD(ibt, stat, val); break; \
 	case XFS_BTNUM_FINO: __XFS_BTREE_STATS_ADD(fibt, stat, val); break; \
-	case XFS_BTNUM_MAX: ASSERT(0); /* fucking gcc */ ; break;	\
+	case XFS_BTNUM_MAX: ASSERT_ALWAYS(0); /* fucking gcc */ ; break; \
 	}       \
 } while (0)

Which we don't want in kernel space, because we want that case to be optimised out by the compiler for production kernels....

What we should really do is properly abstract the btree stats structure and put a pointer into the cursor so that the switch statement can go away....

Cheers,

Dave.

Signature · 7 lines

Dave Chinner
[email protected]

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs

Dave Chinner

2014-08-21 22:50 UTC #5 lore raw

In reply to Eric Sandeen

Quoted 2 lines · Eric Sandeen

The original reason for the expletive below has been lost in the mists of time

Oh, no it hasn't.

That's a switch statement using enums for the cases and so if you don't define every enum value in the switch statement gcc throws warnings. IOWs, the switch statement has to either define them all or contain a "default" case, either of which *does not need to exist* because other code guarantees that the value of cur->bc_btnum is within the valid range.

So, we have to put an invalid value into the switch statement to make gcc shut the fuck up, and the ASSERT(0) is there to indicate that "this should never, ever happen".

Quoted 5 lines

libxfs, and this leads static analysis checkers to believe that XFS_BTNUM_MAX is possible, and that we might overflow an array later when using it as an index.
We can shut this up and mark it as truly impossible with abort().

Random differences between kernel and user code to keep static analysis checkers happy is not a good road to follow, because it will just cause patch failures and people wondering "why is this randomly different to the kernel code?". So, no, I don't really like this approach.

Cheers,

Dave.

Signature · 7 lines

Dave Chinner
[email protected]

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs