<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style="--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;">
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style="font-size: inherit; -webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";">
<div class="content">
<p style="color: #777777;">
<a href="https://gitlab.rtems.org/TheSamPrice">Sam Price</a>
<a href="https://gitlab.rtems.org/rtems/rtos/rtems/-/merge_requests/1440#note_157676">commented</a>:
</p>
<div class="md" style="position: relative; z-index: 1; color: #3a383f; word-wrap: break-word;">
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">The two diagnostics this change answers, from <code style="font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;">gcc -fanalyzer</code> at 15.2.0,
built for <code style="font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;">riscv/mbv</code>:</p>
<div class="gl-relative markdown-code-block js-markdown-code">
<pre class="code highlight js-syntax-highlight language-plaintext" v-pre="true" style="display: block; font-size: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px solid #dcdcde;"><code style="font-size: inherit; color: inherit; word-wrap: normal; word-break: keep-all; background-color: inherit; border-radius: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset;"><span id="LC1" class="line" lang="plaintext" style="margin-top: 0px;">../../../cpukit/libfs/src/jffs2/src/fs-rtems.c:1093:22: warning: use after 'free' of 'root_i' [CWE-416] [-Wanalyzer-use-after-free]</span>
<span id="LC2" class="line" lang="plaintext">../../../cpukit/libfs/src/jffs2/src/fs-rtems.c:1098:9: warning: double-'free' of 'root_i' [CWE-415] [-Wanalyzer-double-free]</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">Both are false positives. The analyser assumes <code style="font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;">jffs2_iput()</code> frees its
argument, which it only does when <code style="font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;">i_count</code> reaches zero <em>and</em> <code style="font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;">i_nlink</code> is
zero. The assert above the call fixes <code style="font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;">i_count</code> at 1, so it turns on the root
inode's link count, which is not visible at that point. The test settles it by
measurement: nine mount and unmount cycles, <code style="font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;">malloc_walk()</code> after each, and a
resource snapshot compared across them.</p>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">The full analyser output, with the event paths it reports, is below.</p>
<details style="margin-bottom: 0px;">
<summary style="margin-top: 0px; font-weight: 600;">gcc -fanalyzer, both diagnostics with event paths (247 lines)</summary>
<div class="gl-relative markdown-code-block js-markdown-code" style="margin-left: 1rem;">
<pre class="code highlight js-syntax-highlight language-plaintext" v-pre="true" style="display: block; font-size: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px solid #dcdcde;"><code style="font-size: inherit; color: inherit; word-wrap: normal; word-break: keep-all; background-color: inherit; border-radius: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset;"><span id="LC1" class="line" lang="plaintext" style="margin-top: 0px;">../../../cpukit/libfs/src/jffs2/src/fs-rtems.c:1093:22: warning: use after 'free' of 'root_i' [CWE-416] [-Wanalyzer-use-after-free]</span>
<span id="LC2" class="line" lang="plaintext"> 1093 | assert(root_i->i_cache_next == NULL);</span>
<span id="LC3" class="line" lang="plaintext"> | ~~~~~~^~~~~~~~~~~~~~</span>
<span id="LC4" class="line" lang="plaintext"> 'rtems_jffs2_fsunmount': events 1-2</span>
<span id="LC5" class="line" lang="plaintext"> │</span>
<span id="LC6" class="line" lang="plaintext"> │ 1073 | static void rtems_jffs2_fsunmount(rtems_filesystem_mount_table_entry_t *mt_entry)</span>
<span id="LC7" class="line" lang="plaintext"> │ | ^~~~~~~~~~~~~~~~~~~~~</span>
<span id="LC8" class="line" lang="plaintext"> │ | |</span>
<span id="LC9" class="line" lang="plaintext"> │ | (1) entry to 'rtems_jffs2_fsunmount'</span>
<span id="LC10" class="line" lang="plaintext"> │......</span>
<span id="LC11" class="line" lang="plaintext"> │ 1092 | icache_evict(root_i, NULL);</span>
<span id="LC12" class="line" lang="plaintext"> │ | ~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
<span id="LC13" class="line" lang="plaintext"> │ | |</span>
<span id="LC14" class="line" lang="plaintext"> │ | (2) calling 'icache_evict' from 'rtems_jffs2_fsunmount'</span>
<span id="LC15" class="line" lang="plaintext"> │</span>
<span id="LC16" class="line" lang="plaintext"> └──> 'icache_evict': events 3-8</span>
<span id="LC17" class="line" lang="plaintext"> │</span>
<span id="LC18" class="line" lang="plaintext"> │ 71 | static void icache_evict(struct _inode *root_i, struct _inode *i)</span>
<span id="LC19" class="line" lang="plaintext"> │ | ^~~~~~~~~~~~</span>
<span id="LC20" class="line" lang="plaintext"> │ | |</span>
<span id="LC21" class="line" lang="plaintext"> │ | (3) entry to 'icache_evict'</span>
<span id="LC22" class="line" lang="plaintext"> │......</span>
<span id="LC23" class="line" lang="plaintext"> │ 80 | while (this) {</span>
<span id="LC24" class="line" lang="plaintext"> │ | ~~~~</span>
<span id="LC25" class="line" lang="plaintext"> │ | |</span>
<span id="LC26" class="line" lang="plaintext"> │ | (4) following 'true' branch (when 'this' is non-NULL)... ─>─┐</span>
<span id="LC27" class="line" lang="plaintext"> │ | │</span>
<span id="LC28" class="line" lang="plaintext"> │ | │</span>
<span id="LC29" class="line" lang="plaintext"> │ |┌───────────────────────────────────────────────────────────────────────────┘</span>
<span id="LC30" class="line" lang="plaintext"> │ 81 |│ next = this->i_cache_next;</span>
<span id="LC31" class="line" lang="plaintext"> │ |│ ~~~~~~~~~~~~~~~~~~~~~~~~~</span>
<span id="LC32" class="line" lang="plaintext"> │ |│ |</span>
<span id="LC33" class="line" lang="plaintext"> │ |└────────────────────>(5) ...to here</span>
<span id="LC34" class="line" lang="plaintext"> │ 82 | if (this != i && this->i_count == 0) {</span>
<span id="LC35" class="line" lang="plaintext"> │ | ~</span>
<span id="LC36" class="line" lang="plaintext"> │ | |</span>
<span id="LC37" class="line" lang="plaintext"> │ | (6) following 'true' branch... ─>─┐</span>
<span id="LC38" class="line" lang="plaintext"> │ | │</span>
<span id="LC39" class="line" lang="plaintext"> │ | │</span>
<span id="LC40" class="line" lang="plaintext"> │ |┌─────────────────────────────────────────────────────┘</span>
<span id="LC41" class="line" lang="plaintext"> │ 83 |│ struct _inode *parent = this->i_parent;</span>
<span id="LC42" class="line" lang="plaintext"> │ |│ ~~~~~~</span>
<span id="LC43" class="line" lang="plaintext"> │ |│ |</span>
<span id="LC44" class="line" lang="plaintext"> │ |└──────────────────────────────────────>(7) ...to here</span>
<span id="LC45" class="line" lang="plaintext"> │......</span>
<span id="LC46" class="line" lang="plaintext"> │ 90 | free(this);</span>
<span id="LC47" class="line" lang="plaintext"> │ | ~~~~~~~~~~</span>
<span id="LC48" class="line" lang="plaintext"> │ | |</span>
<span id="LC49" class="line" lang="plaintext"> │ | (8) freed here</span>
<span id="LC50" class="line" lang="plaintext"> │</span>
<span id="LC51" class="line" lang="plaintext"> <──────┘</span>
<span id="LC52" class="line" lang="plaintext"> │</span>
<span id="LC53" class="line" lang="plaintext"> 'rtems_jffs2_fsunmount': event 9</span>
<span id="LC54" class="line" lang="plaintext"> │</span>
<span id="LC55" class="line" lang="plaintext"> │ 1092 | icache_evict(root_i, NULL);</span>
<span id="LC56" class="line" lang="plaintext"> │ | ^~~~~~~~~~~~~~~~~~~~~~~~~~</span>
<span id="LC57" class="line" lang="plaintext"> │ | |</span>
<span id="LC58" class="line" lang="plaintext"> │ | (9) returning to 'rtems_jffs2_fsunmount' from 'icache_evict'</span>
<span id="LC59" class="line" lang="plaintext"> │</span>
<span id="LC60" class="line" lang="plaintext"> 'rtems_jffs2_fsunmount': event 10</span>
<span id="LC61" class="line" lang="plaintext"> │</span>
<span id="LC62" class="line" lang="plaintext"> │ 1093 | assert(root_i->i_cache_next == NULL);</span>
<span id="LC63" class="line" lang="plaintext"> │ | ~~~~~~^~~~~~~~~~~~~~</span>
<span id="LC64" class="line" lang="plaintext"> │ | |</span>
<span id="LC65" class="line" lang="plaintext"> │ | (10) ⚠️ use after 'free' of 'root_i'; freed at (8)</span>
<span id="LC66" class="line" lang="plaintext"> │</span>
<span id="LC67" class="line" lang="plaintext"></span>
<span id="LC68" class="line" lang="plaintext">../../../cpukit/libfs/src/jffs2/src/fs-rtems.c:1098:9: warning: double-'free' of 'root_i' [CWE-415] [-Wanalyzer-double-free]</span>
<span id="LC69" class="line" lang="plaintext"> 1098 | free(root_i);</span>
<span id="LC70" class="line" lang="plaintext"> | ^~~~~~~~~~~~</span>
<span id="LC71" class="line" lang="plaintext"> 'rtems_jffs2_fsunmount': events 1-2</span>
<span id="LC72" class="line" lang="plaintext"> │</span>
<span id="LC73" class="line" lang="plaintext"> │ 1073 | static void rtems_jffs2_fsunmount(rtems_filesystem_mount_table_entry_t *mt_entry)</span>
<span id="LC74" class="line" lang="plaintext"> │ | ^~~~~~~~~~~~~~~~~~~~~</span>
<span id="LC75" class="line" lang="plaintext"> │ | |</span>
<span id="LC76" class="line" lang="plaintext"> │ | (1) entry to 'rtems_jffs2_fsunmount'</span>
<span id="LC77" class="line" lang="plaintext"> │......</span>
<span id="LC78" class="line" lang="plaintext"> │ 1092 | icache_evict(root_i, NULL);</span>
<span id="LC79" class="line" lang="plaintext"> │ | ~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
<span id="LC80" class="line" lang="plaintext"> │ | |</span>
<span id="LC81" class="line" lang="plaintext"> │ | (2) calling 'icache_evict' from 'rtems_jffs2_fsunmount'</span>
<span id="LC82" class="line" lang="plaintext"> │</span>
<span id="LC83" class="line" lang="plaintext"> └──> 'icache_evict': events 3-4</span>
<span id="LC84" class="line" lang="plaintext"> │</span>
<span id="LC85" class="line" lang="plaintext"> │ 71 | static void icache_evict(struct _inode *root_i, struct _inode *i)</span>
<span id="LC86" class="line" lang="plaintext"> │ | ^~~~~~~~~~~~</span>
<span id="LC87" class="line" lang="plaintext"> │ | |</span>
<span id="LC88" class="line" lang="plaintext"> │ | (3) entry to 'icache_evict'</span>
<span id="LC89" class="line" lang="plaintext"> │......</span>
<span id="LC90" class="line" lang="plaintext"> │ 82 | if (this != i && this->i_count == 0) {</span>
<span id="LC91" class="line" lang="plaintext"> │ | ~</span>
<span id="LC92" class="line" lang="plaintext"> │ | |</span>
<span id="LC93" class="line" lang="plaintext"> │ | (4) following 'true' branch (when 'this != i')... ─>─┐</span>
<span id="LC94" class="line" lang="plaintext"> │ | │</span>
<span id="LC95" class="line" lang="plaintext"> │</span>
<span id="LC96" class="line" lang="plaintext"> 'icache_evict': event 5</span>
<span id="LC97" class="line" lang="plaintext"> │</span>
<span id="LC98" class="line" lang="plaintext"> │ | │</span>
<span id="LC99" class="line" lang="plaintext"> │ |┌────────────────────────────────────────────────────────────────────────┘</span>
<span id="LC100" class="line" lang="plaintext"> │ 82 |│ if (this != i && this->i_count == 0) {</span>
<span id="LC101" class="line" lang="plaintext"> │ |│ ~~~~^~~~~~~~~</span>
<span id="LC102" class="line" lang="plaintext"> │ |│ |</span>
<span id="LC103" class="line" lang="plaintext"> │ |└────────────────────────────────────>(5) ...to here</span>
<span id="LC104" class="line" lang="plaintext"> │</span>
<span id="LC105" class="line" lang="plaintext"> 'icache_evict': event 6</span>
<span id="LC106" class="line" lang="plaintext"> │</span>
<span id="LC107" class="line" lang="plaintext"> │ 82 | if (this != i && this->i_count == 0) {</span>
<span id="LC108" class="line" lang="plaintext"> │ | ~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~</span>
<span id="LC109" class="line" lang="plaintext"> │ | |</span>
<span id="LC110" class="line" lang="plaintext"> │ | (6) following 'false' branch... ─>─┐</span>
<span id="LC111" class="line" lang="plaintext"> │ | │</span>
<span id="LC112" class="line" lang="plaintext"> │</span>
<span id="LC113" class="line" lang="plaintext"> 'icache_evict': event 7</span>
<span id="LC114" class="line" lang="plaintext"> │</span>
<span id="LC115" class="line" lang="plaintext"> │cc1:</span>
<span id="LC116" class="line" lang="plaintext"> │ (7): ...to here</span>
<span id="LC117" class="line" lang="plaintext"> │</span>
<span id="LC118" class="line" lang="plaintext"> <──────┘</span>
<span id="LC119" class="line" lang="plaintext"> │</span>
<span id="LC120" class="line" lang="plaintext"> 'rtems_jffs2_fsunmount': event 8</span>
<span id="LC121" class="line" lang="plaintext"> │</span>
<span id="LC122" class="line" lang="plaintext"> │ 1092 | icache_evict(root_i, NULL);</span>
<span id="LC123" class="line" lang="plaintext"> │ | ^~~~~~~~~~~~~~~~~~~~~~~~~~</span>
<span id="LC124" class="line" lang="plaintext"> │ | |</span>
<span id="LC125" class="line" lang="plaintext"> │ | (8) returning to 'rtems_jffs2_fsunmount' from 'icache_evict'</span>
<span id="LC126" class="line" lang="plaintext"> │</span>
<span id="LC127" class="line" lang="plaintext"> 'rtems_jffs2_fsunmount': event 9</span>
<span id="LC128" class="line" lang="plaintext"> │</span>
<span id="LC129" class="line" lang="plaintext"> │ 1093 | assert(root_i->i_cache_next == NULL);</span>
<span id="LC130" class="line" lang="plaintext"> │ | ~~~~~~^~~~~~~~~~~~~~</span>
<span id="LC131" class="line" lang="plaintext"> │ | |</span>
<span id="LC132" class="line" lang="plaintext"> │ | (9) state of 'INIT_VAL((*INIT_VAL((*INIT_VAL(mt_entry_9(D))).mt_fs_root)).location.node_access)': 'start' -> 'assumed-non-null' (NULL origin)</span>
<span id="LC133" class="line" lang="plaintext"> │</span>
<span id="LC134" class="line" lang="plaintext"> 'rtems_jffs2_fsunmount': event 10</span>
<span id="LC135" class="line" lang="plaintext"> │</span>
<span id="LC136" class="line" lang="plaintext"> │ 1093 | assert(root_i->i_cache_next == NULL);</span>
<span id="LC137" class="line" lang="plaintext"> │ | ^~~~~~</span>
<span id="LC138" class="line" lang="plaintext"> │ | |</span>
<span id="LC139" class="line" lang="plaintext"> │ | (10) following 'false' branch... ─>─┐</span>
<span id="LC140" class="line" lang="plaintext"> │ | │</span>
<span id="LC141" class="line" lang="plaintext"> │</span>
<span id="LC142" class="line" lang="plaintext"> 'rtems_jffs2_fsunmount': event 11</span>
<span id="LC143" class="line" lang="plaintext"> │</span>
<span id="LC144" class="line" lang="plaintext"> │ | │</span>
<span id="LC145" class="line" lang="plaintext"> │ |┌────────────────────────────────────────────┘</span>
<span id="LC146" class="line" lang="plaintext"> │ 1094 |│ assert(root_i->i_count == 1);</span>
<span id="LC147" class="line" lang="plaintext"> │ |│ ~~~~~~^~~~~~~~~</span>
<span id="LC148" class="line" lang="plaintext"> │ |│ |</span>
<span id="LC149" class="line" lang="plaintext"> │ |└────────────────────>(11) ...to here</span>
<span id="LC150" class="line" lang="plaintext"> │</span>
<span id="LC151" class="line" lang="plaintext"> 'rtems_jffs2_fsunmount': event 12</span>
<span id="LC152" class="line" lang="plaintext"> │</span>
<span id="LC153" class="line" lang="plaintext"> │ 1094 | assert(root_i->i_count == 1);</span>
<span id="LC154" class="line" lang="plaintext"> │ | ^~~~~~</span>
<span id="LC155" class="line" lang="plaintext"> │ | |</span>
<span id="LC156" class="line" lang="plaintext"> │ | (12) following 'false' branch... ─>─┐</span>
<span id="LC157" class="line" lang="plaintext"> │ | │</span>
<span id="LC158" class="line" lang="plaintext"> │</span>
<span id="LC159" class="line" lang="plaintext"> 'rtems_jffs2_fsunmount': events 13-14</span>
<span id="LC160" class="line" lang="plaintext"> │</span>
<span id="LC161" class="line" lang="plaintext"> │ | │</span>
<span id="LC162" class="line" lang="plaintext"> │ |┌────────────────────────────────────────────┘</span>
<span id="LC163" class="line" lang="plaintext"> │ 1095 |│ jffs2_iput(root_i);</span>
<span id="LC164" class="line" lang="plaintext"> │ |│ ^~~~~~~~~~~~~~~~~~</span>
<span id="LC165" class="line" lang="plaintext"> │ |│ |</span>
<span id="LC166" class="line" lang="plaintext"> │ |└───────>(13) ...to here</span>
<span id="LC167" class="line" lang="plaintext"> │ | (14) calling 'jffs2_iput' from 'rtems_jffs2_fsunmount'</span>
<span id="LC168" class="line" lang="plaintext"> │</span>
<span id="LC169" class="line" lang="plaintext"> └──> 'jffs2_iput': event 15</span>
<span id="LC170" class="line" lang="plaintext"> │</span>
<span id="LC171" class="line" lang="plaintext"> │ 1617 | void jffs2_iput(struct _inode *i)</span>
<span id="LC172" class="line" lang="plaintext"> │ | ^~~~~~~~~~</span>
<span id="LC173" class="line" lang="plaintext"> │ | |</span>
<span id="LC174" class="line" lang="plaintext"> │ | (15) entry to 'jffs2_iput'</span>
<span id="LC175" class="line" lang="plaintext"> │</span>
<span id="LC176" class="line" lang="plaintext"> 'jffs2_iput': event 16</span>
<span id="LC177" class="line" lang="plaintext"> │</span>
<span id="LC178" class="line" lang="plaintext"> │ 1624 | assert(i != NULL);</span>
<span id="LC179" class="line" lang="plaintext"> │ | ^~~~~~</span>
<span id="LC180" class="line" lang="plaintext"> │ | |</span>
<span id="LC181" class="line" lang="plaintext"> │ | (16) following 'false' branch (when 'i' is non-NULL)... ─>─┐</span>
<span id="LC182" class="line" lang="plaintext"> │ | │</span>
<span id="LC183" class="line" lang="plaintext"> │</span>
<span id="LC184" class="line" lang="plaintext"> 'jffs2_iput': events 17-21</span>
<span id="LC185" class="line" lang="plaintext"> │</span>
<span id="LC186" class="line" lang="plaintext"> │ | │</span>
<span id="LC187" class="line" lang="plaintext"> │ |┌───────────────────────────────────────────────────────────────────┘</span>
<span id="LC188" class="line" lang="plaintext"> │ 1626 |│ i->i_count--;</span>
<span id="LC189" class="line" lang="plaintext"> │ |│ ~^~~~~~~~~</span>
<span id="LC190" class="line" lang="plaintext"> │ |│ |</span>
<span id="LC191" class="line" lang="plaintext"> │ |└────────>(17) ...to here</span>
<span id="LC192" class="line" lang="plaintext"> │ 1627 | </span>
<span id="LC193" class="line" lang="plaintext"> │ 1628 | if (i->i_count < 0)</span>
<span id="LC194" class="line" lang="plaintext"> │ | ~</span>
<span id="LC195" class="line" lang="plaintext"> │ | |</span>
<span id="LC196" class="line" lang="plaintext"> │ | (18) following 'false' branch... ─>─┐</span>
<span id="LC197" class="line" lang="plaintext"> │ | │</span>
<span id="LC198" class="line" lang="plaintext"> │......</span>
<span id="LC199" class="line" lang="plaintext"> │ | │</span>
<span id="LC200" class="line" lang="plaintext"> │ |┌───────────────────────────────────────────────┘</span>
<span id="LC201" class="line" lang="plaintext"> │ 1631 |│ if (i->i_count)</span>
<span id="LC202" class="line" lang="plaintext"> │ |│ ~</span>
<span id="LC203" class="line" lang="plaintext"> │ |│ |</span>
<span id="LC204" class="line" lang="plaintext"> │ |└──────────>(19) ...to here</span>
<span id="LC205" class="line" lang="plaintext"> │ | (20) following 'false' branch... ─>─┐</span>
<span id="LC206" class="line" lang="plaintext"> │ | │</span>
<span id="LC207" class="line" lang="plaintext"> │......</span>
<span id="LC208" class="line" lang="plaintext"> │ | │</span>
<span id="LC209" class="line" lang="plaintext"> │ |┌───────────────────────────────────────────────┘</span>
<span id="LC210" class="line" lang="plaintext"> │ 1634 |│ if (!i->i_nlink) {</span>
<span id="LC211" class="line" lang="plaintext"> │ |│ ~~~~~~~~~~</span>
<span id="LC212" class="line" lang="plaintext"> │ |│ |</span>
<span id="LC213" class="line" lang="plaintext"> │ |└─────────────>(21) ...to here</span>
<span id="LC214" class="line" lang="plaintext"> │</span>
<span id="LC215" class="line" lang="plaintext"> 'jffs2_iput': events 22-24</span>
<span id="LC216" class="line" lang="plaintext"> │</span>
<span id="LC217" class="line" lang="plaintext"> │ 1634 | if (!i->i_nlink) {</span>
<span id="LC218" class="line" lang="plaintext"> │ | ^</span>
<span id="LC219" class="line" lang="plaintext"> │ | |</span>
<span id="LC220" class="line" lang="plaintext"> │ | (22) following 'true' branch... ─>─┐</span>
<span id="LC221" class="line" lang="plaintext"> │ | │</span>
<span id="LC222" class="line" lang="plaintext"> │......</span>
<span id="LC223" class="line" lang="plaintext"> │ | │</span>
<span id="LC224" class="line" lang="plaintext"> │ |┌──────────────────────────────────────────────┘</span>
<span id="LC225" class="line" lang="plaintext"> │ 1638 |│ if (i->i_cache_prev)</span>
<span id="LC226" class="line" lang="plaintext"> │ |│ ~~~~~~~~~~~~~~~</span>
<span id="LC227" class="line" lang="plaintext"> │ |│ |</span>
<span id="LC228" class="line" lang="plaintext"> │ |└────────────────────>(23) ...to here</span>
<span id="LC229" class="line" lang="plaintext"> │......</span>
<span id="LC230" class="line" lang="plaintext"> │ 1646 | free(i);</span>
<span id="LC231" class="line" lang="plaintext"> │ | ~~~~~~~</span>
<span id="LC232" class="line" lang="plaintext"> │ | |</span>
<span id="LC233" class="line" lang="plaintext"> │ | (24) first 'free' here</span>
<span id="LC234" class="line" lang="plaintext"> │</span>
<span id="LC235" class="line" lang="plaintext"> <──────┘</span>
<span id="LC236" class="line" lang="plaintext"> │</span>
<span id="LC237" class="line" lang="plaintext"> 'rtems_jffs2_fsunmount': events 25-26</span>
<span id="LC238" class="line" lang="plaintext"> │</span>
<span id="LC239" class="line" lang="plaintext"> │ 1095 | jffs2_iput(root_i);</span>
<span id="LC240" class="line" lang="plaintext"> │ | ^~~~~~~~~~~~~~~~~~</span>
<span id="LC241" class="line" lang="plaintext"> │ | |</span>
<span id="LC242" class="line" lang="plaintext"> │ | (25) returning to 'rtems_jffs2_fsunmount' from 'jffs2_iput'</span>
<span id="LC243" class="line" lang="plaintext"> │......</span>
<span id="LC244" class="line" lang="plaintext"> │ 1098 | free(root_i);</span>
<span id="LC245" class="line" lang="plaintext"> │ | ~~~~~~~~~~~~</span>
<span id="LC246" class="line" lang="plaintext"> │ | |</span>
<span id="LC247" class="line" lang="plaintext"> │ | (26) ⚠️ second 'free' here; first 'free' was at (24)</span>
<span id="LC248" class="line" lang="plaintext"> │</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
</details>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #626168;">
—
<br>
<a href="https://gitlab.rtems.org/rtems/rtos/rtems/-/merge_requests/1440#note_157676">View it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.rtems.org">gitlab.rtems.org</a>. <a href="https://gitlab.rtems.org/-/sent_notifications/5-2635qsv5cljo0p9tugmdtjd22-1d/unsubscribe" target="_blank" rel="noopener noreferrer">Unsubscribe</a> from this thread · <a href="https://gitlab.rtems.org/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.rtems.org/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<span style="color: transparent; font-size: 0; display: none; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.rtems.org/rtems/rtos/rtems/-/merge_requests/1440#note_157676 at 1787284353
</span>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Merge request","url":"https://gitlab.rtems.org/rtems/rtos/rtems/-/merge_requests/1440#note_157676"}}</script>
</p>
</div>
</body>
</html>