objtool: drivers/media/pci/solo6x10/solo6x10.o: tw28_set_ctrl_val() falls through to next function __cfi_tw28_get_ctrl_val()

[dileks]

When building Linux v6.18 Final with Clang-kCFI enabled I see these objtool warnings:

$ grep warning: build-log_6.18.0-1-amd64-clang19-kcfi.txt | grep objtool:
drivers/media/pci/solo6x10/solo6x10.o: warning: objtool: tw28_set_ctrl_val() falls through to next function __cfi_tw28_get_ctrl_val()
vmlinux.o: warning: objtool: dw_i2c_plat_remove+0xd3: no-cfi indirect call!

The second one was fixed - but not for v6.18
#2133

My make-line:

/usr/bin/perf stat make V=1 -k -j4 ARCH=x86_64 LLVM=1 LLVM=/opt/llvm/bin/ PAHOLE=/usr/bin/pahole KBUILD_BUILD_HOST=iniza KBUILD_BUILD_USER=sedat.dilek@gmail.com KBUILD_BUILD_TIMESTAMP=2025-12-01 KDEB_PKGVERSION=6.18.0-1~forky+dileks LOCALVERSION=-1-amd64-clang19-kcfi olddefconfig bindeb-pkg

My kernel-config is attached.

config-6.18.0-1-amd64-clang19-kcfi.txt

[dileks]

The same warning with SLIM LLVM v21.1.7 from kernel.org

[nathanchance]

This appears to be related to CONFIG_UBSAN_SHIFT based on my configuration bisect between Arch Linux's and Debian's configurations (cc @kees).

I think this is related to the left shift of 1 (a signed integer literal) in is_tw286x. Changing it to use BIT(), which uses 1U (an unsigned integer literal).

diff --git a/drivers/media/pci/solo6x10/solo6x10-tw28.c b/drivers/media/pci/solo6x10/solo6x10-tw28.c
index 1b7c22a9bc94..c5f549533a82 100644
--- a/drivers/media/pci/solo6x10/solo6x10-tw28.c
+++ b/drivers/media/pci/solo6x10/solo6x10-tw28.c
@@ -166,7 +166,7 @@ static const u8 tbl_tw2865_pal_template[] = {
        0x64, 0x51, 0x40, 0xaf, 0xFF, 0xF0, 0x00, 0xC0,
 };

-#define is_tw286x(__solo, __id) (!(__solo->tw2815 & (1 << __id)))
+#define is_tw286x(__solo, __id) (!(__solo->tw2815 & BIT(__id)))

 static u8 tw_readbyte(struct solo_dev *solo_dev, int chip_id, u8 tw6x_off,
                      u8 tw_off)

[dileks]

@nathanchance

Was that warning visible without [FEATURE] CFI?

Will there be a formal patch for this?

Yesterday was a media merge into Linus tree, I did not see any patch in that area.
Will you inform/CC maintainers of media tree?

[dileks]

Yes, Debian uses CONFIG_UBSAN_SHIFT=y.

[nathanchance]

Was that warning visible without [FEATURE] CFI?

Yes, this is visible with stock Debian and Fedora configurations, which do not have CONFIG_CFI or CONFIG_CFI_CLANG.

Will there be a formal patch for this?

Yes but probably not until after Plumbers.

Yesterday was a media merge into Linus tree, I did not see any patch in that area. Will you inform/CC maintainers of media tree?

Yes since that is who I will send the patch to.

[kees]

Usually when we get "falls through to next function" objtool warnings it's because Clang has decided to elide an entire function. And since this is UBSan related, I'm worried Clang has found some odd-ball UB again. I fixed a recent case of this with llvm/llvm-project@ea2e66aa8b6e, which first appeared in llvmorg-21.1.0, AFAICT. But you're seeing it with 21.1.7, so this is probably something new.

I'll try to take a look, but I'm travelling to the Plumbers conference tomorrow...

[nathanchance]

If we have time, we could sit down at Plumbers and take a look together.

[dileks]

"WE are with you in spirit." (Hybris - An Amiga Game)

[kees]

I've sent this, which adds explicit bounds checking and makes the shift unsigned. This is another case of the "Clang sanitizer finds a UB and warns but then continues and tries to use UB again and blows up".

https://lore.kernel.org/linux-hardening/20251212030030.work.534-kees@kernel.org/