warning: objtool: ccs_set_selection(): unexpected end of section .text.ccs_set_selection

[nathanchance]

$ cat allno.config
CONFIG_COMMON_CLK=y
# CONFIG_LTO_NONE is not set
CONFIG_LTO_CLANG_THIN=y
CONFIG_I2C=y
CONFIG_MEDIA_CAMERA_SUPPORT=y
CONFIG_MEDIA_SUPPORT=y
CONFIG_MODULES=y
CONFIG_VIDEO_CAMERA_SENSOR=y
CONFIG_VIDEO_CCS=m
CONFIG_VIDEO_DEV=y

$ make -skj"$(nproc)" ARCH=x86_64 KCONFIG_ALLCONFIG=1 LLVM=1 clean allnoconfig drivers/media/i2c/ccs/ccs.o
drivers/media/i2c/ccs/ccs.o: warning: objtool: ccs_set_selection(): unexpected end of section .text.ccs_set_selection

This likely involves some sort of undefined behavior that is only apparent from inlining that LTO enables.

[nathanchance]

This was introduced by llvm/llvm-project@3793264. I do not immediately see where the potential divide by zero is but I did not look too hard.

[nathanchance]

This reproduces without LTO:

$ cat allno.config
CONFIG_COMMON_CLK=y
CONFIG_I2C=y
CONFIG_MEDIA_CAMERA_SUPPORT=y
CONFIG_MEDIA_SUPPORT=y
CONFIG_MODULES=y
CONFIG_VIDEO_CAMERA_SENSOR=y
CONFIG_VIDEO_CCS=m
CONFIG_VIDEO_DEV=y

$ make -skj"$(nproc)" ARCH=x86_64 KCONFIG_ALLCONFIG=1 LLVM=1 clean allnoconfig drivers/media/i2c/ccs/ccs.o
drivers/media/i2c/ccs/ccs-core.o: warning: objtool: ccs_set_selection() falls through to next function ccs_propagate()

I did some investigating to try and see where LLVM thinks there will be a potential divide by zero and it looks like something in ccs_set_compose_scaler() triggers this (which does have some unchecked division) but I do not see how LLVM is able to infer that one of these values will definitively be zero...

With

diff --git a/drivers/media/i2c/ccs/ccs-core.c b/drivers/media/i2c/ccs/ccs-core.c
index 1c889c878abd..5d0f52176626 100644
--- a/drivers/media/i2c/ccs/ccs-core.c
+++ b/drivers/media/i2c/ccs/ccs-core.c
@@ -2360,6 +2360,7 @@ static void ccs_set_compose_scaler(struct v4l2_subdev *subdev,
        min = min(max_m, min(a, b));
        max = min(max_m, max(a, b));

+#if 0
        try[ntry] = min;
        ntry++;
        if (min != max) {
@@ -2432,6 +2433,7 @@ static void ccs_set_compose_scaler(struct v4l2_subdev *subdev,
                sensor->scale_m = scale_m;
                sensor->scaling_mode = mode;
        }
+#endif
 }
 /* We're only called on source pads. This function sets scaling. */
 static int ccs_set_compose(struct v4l2_subdev *subdev,

there is no warning but with

diff --git a/drivers/media/i2c/ccs/ccs-core.c b/drivers/media/i2c/ccs/ccs-core.c
index 1c889c878abd..9f998d030773 100644
--- a/drivers/media/i2c/ccs/ccs-core.c
+++ b/drivers/media/i2c/ccs/ccs-core.c
@@ -2375,6 +2375,7 @@ static void ccs_set_compose_scaler(struct v4l2_subdev *subdev,
                }
        }

+#if 0
        for (i = 0; i < ntry; i++) {
                int this = scaling_goodness(
                        subdev,
@@ -2432,6 +2433,7 @@ static void ccs_set_compose_scaler(struct v4l2_subdev *subdev,
                sensor->scale_m = scale_m;
                sensor->scaling_mode = mode;
        }
+#endif
 }
 /* We're only called on source pads. This function sets scaling. */
 static int ccs_set_compose(struct v4l2_subdev *subdev,

there is, which would seem to indicate some issue with

    try[ntry] = min;
    ntry++;
    if (min != max) {
        try[ntry] = max;
        ntry++;
    }
    if (max != max_m) {
        try[ntry] = min + 1;
        ntry++;
        if (min != max) {
            try[ntry] = max + 1;
            ntry++;
        }
    }

but that makes very little sense for the commit that this bisected to as there is no division in that block... plus something like

diff --git a/drivers/media/i2c/ccs/ccs-core.c b/drivers/media/i2c/ccs/ccs-core.c
index 1c889c878abd..bfe8d9819fc9 100644
--- a/drivers/media/i2c/ccs/ccs-core.c
+++ b/drivers/media/i2c/ccs/ccs-core.c
@@ -2360,6 +2360,9 @@ static void ccs_set_compose_scaler(struct v4l2_subdev *subdev,
        min = min(max_m, min(a, b));
        max = min(max_m, max(a, b));

+       if (min < 1 || max < 1 || scale_m < 1)
+               return;
+
        try[ntry] = min;
        ntry++;
        if (min != max) {

changes nothing.

[nathanchance]

https://lore.kernel.org/20251124230045.3188417-1-sakari.ailus@linux.intel.com/

[nathanchance]

Now applied to the media tree: https://git.linuxtv.org/media.git/commit/?id=679f0b7b6a409750a25754c8833e268e5fdde742

[nathanchance]

https://git.kernel.org/linus/679f0b7b6a409750a25754c8833e268e5fdde742