java -Xmx6000000000 -jar ./plugins/org.eclipse.equinox.launcher_1.3.100.v20150511-1540.jar -data ./data --generate-csv --csv-dir ../../../releaseScripts/default/UAutomizer-linux/csv -tc ../../../trunk/examples/toolchains/AbstractInterpretationC.xml -s ../../../trunk/examples/settings/ai/eq-bench/svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf -i ../../../trunk/examples/svcomp/ldv-memsafety/memleaks_test12_false-valid-free.i -------------------------------------------------------------------------------- This is Ultimate 0.1.23-6b94a2f [2018-01-24 16:29:57,021 INFO L170 SettingsManager]: Resetting all preferences to default values... [2018-01-24 16:29:57,024 INFO L174 SettingsManager]: Resetting UltimateCore preferences to default values [2018-01-24 16:29:57,037 INFO L177 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2018-01-24 16:29:57,038 INFO L174 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2018-01-24 16:29:57,038 INFO L174 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2018-01-24 16:29:57,040 INFO L174 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2018-01-24 16:29:57,041 INFO L174 SettingsManager]: Resetting LassoRanker preferences to default values [2018-01-24 16:29:57,043 INFO L174 SettingsManager]: Resetting Reaching Definitions preferences to default values [2018-01-24 16:29:57,044 INFO L174 SettingsManager]: Resetting SyntaxChecker preferences to default values [2018-01-24 16:29:57,045 INFO L177 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2018-01-24 16:29:57,045 INFO L174 SettingsManager]: Resetting LTL2Aut preferences to default values [2018-01-24 16:29:57,046 INFO L174 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2018-01-24 16:29:57,047 INFO L174 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2018-01-24 16:29:57,047 INFO L174 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2018-01-24 16:29:57,050 INFO L174 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2018-01-24 16:29:57,052 INFO L174 SettingsManager]: Resetting CodeCheck preferences to default values [2018-01-24 16:29:57,054 INFO L174 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2018-01-24 16:29:57,056 INFO L174 SettingsManager]: Resetting RCFGBuilder preferences to default values [2018-01-24 16:29:57,057 INFO L174 SettingsManager]: Resetting TraceAbstraction preferences to default values [2018-01-24 16:29:57,059 INFO L177 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2018-01-24 16:29:57,059 INFO L177 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2018-01-24 16:29:57,060 INFO L174 SettingsManager]: Resetting IcfgTransformer preferences to default values [2018-01-24 16:29:57,061 INFO L174 SettingsManager]: Resetting Boogie Printer preferences to default values [2018-01-24 16:29:57,062 INFO L174 SettingsManager]: Resetting Witness Printer preferences to default values [2018-01-24 16:29:57,063 INFO L177 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2018-01-24 16:29:57,063 INFO L174 SettingsManager]: Resetting CDTParser preferences to default values [2018-01-24 16:29:57,064 INFO L177 SettingsManager]: PEA to Boogie provides no preferences, ignoring... [2018-01-24 16:29:57,064 INFO L177 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2018-01-24 16:29:57,064 INFO L174 SettingsManager]: Resetting Witness Parser preferences to default values [2018-01-24 16:29:57,065 INFO L181 SettingsManager]: Finished resetting all preferences to default values... [2018-01-24 16:29:57,065 INFO L98 SettingsManager]: Beginning loading settings from /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../trunk/examples/settings/ai/eq-bench/svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf [2018-01-24 16:29:57,075 INFO L110 SettingsManager]: Loading preferences was successful [2018-01-24 16:29:57,075 INFO L112 SettingsManager]: Preferences different from defaults after loading the file: [2018-01-24 16:29:57,076 INFO L131 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2018-01-24 16:29:57,076 INFO L133 SettingsManager]: * to procedures, called more than once=true [2018-01-24 16:29:57,077 INFO L131 SettingsManager]: Preferences of Abstract Interpretation differ from their defaults: [2018-01-24 16:29:57,077 INFO L133 SettingsManager]: * Deactivate Weak Equivalences=true [2018-01-24 16:29:57,077 INFO L133 SettingsManager]: * Abstract domain for RCFG-of-the-future=VPDomain [2018-01-24 16:29:57,077 INFO L133 SettingsManager]: * Use the RCFG-of-the-future interface=true [2018-01-24 16:29:57,078 INFO L131 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2018-01-24 16:29:57,078 INFO L133 SettingsManager]: * sizeof long=4 [2018-01-24 16:29:57,078 INFO L133 SettingsManager]: * Check unreachability of error function in SV-COMP mode=false [2018-01-24 16:29:57,078 INFO L133 SettingsManager]: * Overapproximate operations on floating types=true [2018-01-24 16:29:57,079 INFO L133 SettingsManager]: * sizeof POINTER=4 [2018-01-24 16:29:57,079 INFO L133 SettingsManager]: * Check division by zero=IGNORE [2018-01-24 16:29:57,079 INFO L133 SettingsManager]: * Check for the main procedure if all allocated memory was freed=true [2018-01-24 16:29:57,079 INFO L133 SettingsManager]: * Bitprecise bitfields=true [2018-01-24 16:29:57,079 INFO L133 SettingsManager]: * SV-COMP memtrack compatibility mode=true [2018-01-24 16:29:57,079 INFO L133 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2018-01-24 16:29:57,080 INFO L133 SettingsManager]: * sizeof long double=12 [2018-01-24 16:29:57,080 INFO L131 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2018-01-24 16:29:57,080 INFO L133 SettingsManager]: * Size of a code block=SequenceOfStatements [2018-01-24 16:29:57,080 INFO L133 SettingsManager]: * To the following directory=./dump/ [2018-01-24 16:29:57,080 INFO L133 SettingsManager]: * Add additional assume for each assert=false [2018-01-24 16:29:57,081 INFO L133 SettingsManager]: * SMT solver=External_DefaultMode [2018-01-24 16:29:57,081 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-01-24 16:29:57,081 INFO L131 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2018-01-24 16:29:57,081 INFO L133 SettingsManager]: * Interpolant automaton=TWOTRACK [2018-01-24 16:29:57,081 INFO L133 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2018-01-24 16:29:57,082 INFO L133 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2018-01-24 16:29:57,082 INFO L133 SettingsManager]: * Trace refinement strategy=CAMEL [2018-01-24 16:29:57,082 INFO L133 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2018-01-24 16:29:57,082 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in [2018-01-24 16:29:57,082 INFO L133 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2018-01-24 16:29:57,083 INFO L131 SettingsManager]: Preferences of IcfgTransformer differ from their defaults: [2018-01-24 16:29:57,083 INFO L133 SettingsManager]: * TransformationType=HEAP_SEPARATOR [2018-01-24 16:29:57,118 INFO L81 nceAwareModelManager]: Repository-Root is: /tmp [2018-01-24 16:29:57,131 INFO L266 ainManager$Toolchain]: [Toolchain 1]: Parser(s) successfully initialized [2018-01-24 16:29:57,135 INFO L222 ainManager$Toolchain]: [Toolchain 1]: Toolchain data selected. [2018-01-24 16:29:57,137 INFO L271 PluginConnector]: Initializing CDTParser... [2018-01-24 16:29:57,137 INFO L276 PluginConnector]: CDTParser initialized [2018-01-24 16:29:57,138 INFO L431 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../trunk/examples/svcomp/ldv-memsafety/memleaks_test12_false-valid-free.i [2018-01-24 16:29:57,326 INFO L304 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2018-01-24 16:29:57,332 INFO L131 ToolchainWalker]: Walking toolchain with 4 elements. [2018-01-24 16:29:57,333 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2018-01-24 16:29:57,333 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2018-01-24 16:29:57,337 INFO L276 PluginConnector]: CACSL2BoogieTranslator initialized [2018-01-24 16:29:57,338 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 24.01 04:29:57" (1/1) ... [2018-01-24 16:29:57,341 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@6727febd and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:29:57, skipping insertion in model container [2018-01-24 16:29:57,341 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 24.01 04:29:57" (1/1) ... [2018-01-24 16:29:57,360 INFO L153 Dispatcher]: Using SV-COMP mode [2018-01-24 16:29:57,415 INFO L153 Dispatcher]: Using SV-COMP mode [2018-01-24 16:29:57,560 INFO L450 PostProcessor]: Settings: Checked method=main [2018-01-24 16:29:57,601 INFO L450 PostProcessor]: Settings: Checked method=main [2018-01-24 16:29:57,617 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:29:57 WrapperNode [2018-01-24 16:29:57,618 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2018-01-24 16:29:57,618 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2018-01-24 16:29:57,619 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2018-01-24 16:29:57,619 INFO L276 PluginConnector]: Boogie Preprocessor initialized [2018-01-24 16:29:57,635 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:29:57" (1/1) ... [2018-01-24 16:29:57,635 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:29:57" (1/1) ... [2018-01-24 16:29:57,649 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:29:57" (1/1) ... [2018-01-24 16:29:57,650 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:29:57" (1/1) ... [2018-01-24 16:29:57,660 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:29:57" (1/1) ... [2018-01-24 16:29:57,664 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:29:57" (1/1) ... [2018-01-24 16:29:57,667 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:29:57" (1/1) ... [2018-01-24 16:29:57,671 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2018-01-24 16:29:57,671 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2018-01-24 16:29:57,671 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2018-01-24 16:29:57,671 INFO L276 PluginConnector]: RCFGBuilder initialized [2018-01-24 16:29:57,672 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:29:57" (1/1) ... No working directory specified, using /storage/ultimate/releaseScripts/default/UAutomizer-linux/z3 Starting monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-01-24 16:29:57,716 INFO L136 BoogieDeclarations]: Found implementation of procedure ULTIMATE.init [2018-01-24 16:29:57,717 INFO L136 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2018-01-24 16:29:57,717 INFO L136 BoogieDeclarations]: Found implementation of procedure ##fun~$Pointer$~X~$Pointer$~X~int~TO~int [2018-01-24 16:29:57,717 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2018-01-24 16:29:57,717 INFO L136 BoogieDeclarations]: Found implementation of procedure LDV_INIT_LIST_HEAD [2018-01-24 16:29:57,717 INFO L136 BoogieDeclarations]: Found implementation of procedure __ldv_list_add [2018-01-24 16:29:57,717 INFO L136 BoogieDeclarations]: Found implementation of procedure __ldv_list_del [2018-01-24 16:29:57,717 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_list_add [2018-01-24 16:29:57,717 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_list_del [2018-01-24 16:29:57,717 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_msg_alloc [2018-01-24 16:29:57,718 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_msg_fill [2018-01-24 16:29:57,718 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_msg_free [2018-01-24 16:29:57,718 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_submit_msg [2018-01-24 16:29:57,718 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_destroy_msgs [2018-01-24 16:29:57,718 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_dev_get_drvdata [2018-01-24 16:29:57,718 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_dev_set_drvdata [2018-01-24 16:29:57,718 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_kobject_cleanup [2018-01-24 16:29:57,718 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_kobject_release [2018-01-24 16:29:57,718 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_i2c_get_clientdata [2018-01-24 16:29:57,718 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_i2c_set_clientdata [2018-01-24 16:29:57,719 INFO L136 BoogieDeclarations]: Found implementation of procedure master_xfer [2018-01-24 16:29:57,719 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_i2c_transfer [2018-01-24 16:29:57,719 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_m88ts2022_rd_reg [2018-01-24 16:29:57,719 INFO L136 BoogieDeclarations]: Found implementation of procedure alloc_12 [2018-01-24 16:29:57,719 INFO L136 BoogieDeclarations]: Found implementation of procedure free_12 [2018-01-24 16:29:57,719 INFO L136 BoogieDeclarations]: Found implementation of procedure entry_point [2018-01-24 16:29:57,719 INFO L136 BoogieDeclarations]: Found implementation of procedure main [2018-01-24 16:29:57,719 INFO L128 BoogieDeclarations]: Found specification of procedure write~int [2018-01-24 16:29:57,720 INFO L128 BoogieDeclarations]: Found specification of procedure read~int [2018-01-24 16:29:57,720 INFO L128 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2018-01-24 16:29:57,720 INFO L128 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2018-01-24 16:29:57,720 INFO L128 BoogieDeclarations]: Found specification of procedure ULTIMATE.free [2018-01-24 16:29:57,720 INFO L128 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2018-01-24 16:29:57,720 INFO L128 BoogieDeclarations]: Found specification of procedure #Ultimate.alloc [2018-01-24 16:29:57,720 INFO L128 BoogieDeclarations]: Found specification of procedure #Ultimate.C_memcpy [2018-01-24 16:29:57,720 INFO L136 BoogieDeclarations]: Found implementation of procedure #Ultimate.C_memcpy [2018-01-24 16:29:57,720 INFO L128 BoogieDeclarations]: Found specification of procedure malloc [2018-01-24 16:29:57,720 INFO L128 BoogieDeclarations]: Found specification of procedure free [2018-01-24 16:29:57,720 INFO L128 BoogieDeclarations]: Found specification of procedure __VERIFIER_nondet_int [2018-01-24 16:29:57,721 INFO L128 BoogieDeclarations]: Found specification of procedure memcpy [2018-01-24 16:29:57,721 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_malloc [2018-01-24 16:29:57,721 INFO L128 BoogieDeclarations]: Found specification of procedure LDV_INIT_LIST_HEAD [2018-01-24 16:29:57,721 INFO L128 BoogieDeclarations]: Found specification of procedure __ldv_list_add [2018-01-24 16:29:57,721 INFO L128 BoogieDeclarations]: Found specification of procedure __ldv_list_del [2018-01-24 16:29:57,721 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_list_add [2018-01-24 16:29:57,721 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_list_del [2018-01-24 16:29:57,721 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_msg_alloc [2018-01-24 16:29:57,722 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_msg_fill [2018-01-24 16:29:57,722 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_msg_free [2018-01-24 16:29:57,722 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_submit_msg [2018-01-24 16:29:57,722 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_destroy_msgs [2018-01-24 16:29:57,722 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_dev_get_drvdata [2018-01-24 16:29:57,722 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_dev_set_drvdata [2018-01-24 16:29:57,723 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_kobject_cleanup [2018-01-24 16:29:57,723 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_kobject_release [2018-01-24 16:29:57,723 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_i2c_get_clientdata [2018-01-24 16:29:57,723 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_i2c_set_clientdata [2018-01-24 16:29:57,723 INFO L128 BoogieDeclarations]: Found specification of procedure master_xfer [2018-01-24 16:29:57,723 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_i2c_transfer [2018-01-24 16:29:57,723 INFO L128 BoogieDeclarations]: Found specification of procedure ##fun~$Pointer$~X~$Pointer$~X~int~TO~int [2018-01-24 16:29:57,724 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_m88ts2022_rd_reg [2018-01-24 16:29:57,724 INFO L128 BoogieDeclarations]: Found specification of procedure alloc_12 [2018-01-24 16:29:57,724 INFO L128 BoogieDeclarations]: Found specification of procedure free_12 [2018-01-24 16:29:57,724 INFO L128 BoogieDeclarations]: Found specification of procedure entry_point [2018-01-24 16:29:57,724 INFO L128 BoogieDeclarations]: Found specification of procedure main [2018-01-24 16:29:57,724 INFO L128 BoogieDeclarations]: Found specification of procedure ULTIMATE.init [2018-01-24 16:29:57,724 INFO L128 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2018-01-24 16:29:58,636 WARN L455 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-01-24 16:29:58,739 INFO L257 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2018-01-24 16:29:58,740 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 24.01 04:29:58 BoogieIcfgContainer [2018-01-24 16:29:58,740 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2018-01-24 16:29:58,740 INFO L113 PluginConnector]: ------------------------Abstract Interpretation---------------------------- [2018-01-24 16:29:58,741 INFO L271 PluginConnector]: Initializing Abstract Interpretation... [2018-01-24 16:29:58,741 INFO L276 PluginConnector]: Abstract Interpretation initialized [2018-01-24 16:29:58,742 INFO L185 PluginConnector]: Executing the observer AbstractInterpretationRcfgObserver from plugin Abstract Interpretation for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 24.01 04:29:58" (1/1) ... [2018-01-24 16:29:58,802 INFO L101 FixpointEngine]: Starting fixpoint engine with domain VPDomain (maxUnwinding=3, maxParallelStates=2) [2018-01-24 16:30:05,792 INFO L259 AbstractInterpreter]: Some error location(s) were reachable [2018-01-24 16:30:06,146 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification ensures #valid == old(#valid); is not ensure(true) [2018-01-24 16:30:06,185 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,189 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,191 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,193 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,195 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,196 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,198 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,200 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,207 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,208 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,209 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,211 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,213 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,216 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,218 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,220 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,222 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,223 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,225 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,228 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,230 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,232 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,234 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,237 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,239 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,241 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,244 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,246 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,248 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,251 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,253 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,255 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,258 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,258 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,260 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,261 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,263 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,263 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,265 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,266 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,268 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,268 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,271 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,271 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,273 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,274 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,276 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,277 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,279 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,280 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,282 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,283 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,285 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,286 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,288 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,289 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,291 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,292 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,294 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,295 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,295 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,298 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,298 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,299 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,301 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,302 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,305 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,305 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,305 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,308 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,309 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,309 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,312 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,312 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,315 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,316 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,316 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,319 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,319 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,320 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,323 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,323 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,323 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,326 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,327 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,327 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,330 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,330 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,331 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,334 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,334 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,334 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,337 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,337 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,338 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,340 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,341 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,341 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,344 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,344 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,344 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,348 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,348 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,348 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,351 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,352 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,352 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:30:06,357 INFO L268 AbstractInterpreter]: Visited 433 different actions 1776 times. Merged at 122 different actions 482 times. Widened at 4 different actions 4 times. Found 78 fixpoints after 35 different actions. Largest state had 54 variables. [2018-01-24 16:30:06,360 INFO L132 PluginConnector]: ------------------------ END Abstract Interpretation---------------------------- [2018-01-24 16:30:06,361 INFO L168 Benchmark]: Toolchain (without parser) took 9034.23 ms. Allocated memory was 304.6 MB in the beginning and 1.3 GB in the end (delta: 964.2 MB). Free memory was 263.5 MB in the beginning and 1.1 GB in the end (delta: -872.8 MB). Peak memory consumption was 768.2 MB. Max. memory is 5.3 GB. [2018-01-24 16:30:06,362 INFO L168 Benchmark]: CDTParser took 0.18 ms. Allocated memory is still 304.6 MB. Free memory is still 270.5 MB. There was no memory consumed. Max. memory is 5.3 GB. [2018-01-24 16:30:06,362 INFO L168 Benchmark]: CACSL2BoogieTranslator took 285.48 ms. Allocated memory is still 304.6 MB. Free memory was 263.5 MB in the beginning and 246.4 MB in the end (delta: 17.1 MB). Peak memory consumption was 17.1 MB. Max. memory is 5.3 GB. [2018-01-24 16:30:06,362 INFO L168 Benchmark]: Boogie Preprocessor took 52.49 ms. Allocated memory is still 304.6 MB. Free memory was 246.4 MB in the beginning and 243.4 MB in the end (delta: 3.0 MB). Peak memory consumption was 3.0 MB. Max. memory is 5.3 GB. [2018-01-24 16:30:06,363 INFO L168 Benchmark]: RCFGBuilder took 1068.69 ms. Allocated memory was 304.6 MB in the beginning and 326.6 MB in the end (delta: 22.0 MB). Free memory was 243.4 MB in the beginning and 261.4 MB in the end (delta: -17.9 MB). Peak memory consumption was 69.0 MB. Max. memory is 5.3 GB. [2018-01-24 16:30:06,363 INFO L168 Benchmark]: Abstract Interpretation took 7619.35 ms. Allocated memory was 326.6 MB in the beginning and 1.3 GB in the end (delta: 942.1 MB). Free memory was 259.9 MB in the beginning and 1.1 GB in the end (delta: -876.4 MB). Peak memory consumption was 742.5 MB. Max. memory is 5.3 GB. [2018-01-24 16:30:06,365 INFO L344 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.18 ms. Allocated memory is still 304.6 MB. Free memory is still 270.5 MB. There was no memory consumed. Max. memory is 5.3 GB. * CACSL2BoogieTranslator took 285.48 ms. Allocated memory is still 304.6 MB. Free memory was 263.5 MB in the beginning and 246.4 MB in the end (delta: 17.1 MB). Peak memory consumption was 17.1 MB. Max. memory is 5.3 GB. * Boogie Preprocessor took 52.49 ms. Allocated memory is still 304.6 MB. Free memory was 246.4 MB in the beginning and 243.4 MB in the end (delta: 3.0 MB). Peak memory consumption was 3.0 MB. Max. memory is 5.3 GB. * RCFGBuilder took 1068.69 ms. Allocated memory was 304.6 MB in the beginning and 326.6 MB in the end (delta: 22.0 MB). Free memory was 243.4 MB in the beginning and 261.4 MB in the end (delta: -17.9 MB). Peak memory consumption was 69.0 MB. Max. memory is 5.3 GB. * Abstract Interpretation took 7619.35 ms. Allocated memory was 326.6 MB in the beginning and 1.3 GB in the end (delta: 942.1 MB). Free memory was 259.9 MB in the beginning and 1.1 GB in the end (delta: -876.4 MB). Peak memory consumption was 742.5 MB. Max. memory is 5.3 GB. * Results from de.uni_freiburg.informatik.ultimate.plugins.analysis.abstractinterpretationv2: - StatisticsResult: ArrayEqualityDomainStatistics #Locations : 365 LocStat_MAX_WEQGRAPH_SIZE : 0 LocStat_MAX_SIZEOF_WEQEDGELABEL : 0 LocStat_NO_SUPPORTING_EQUALITIES : 4257 LocStat_NO_SUPPORTING_DISEQUALITIES : 2441 LocStat_NO_DISJUNCTIONS : -730 LocStat_MAX_NO_DISJUNCTIONS : -1 #Transitions : 483 TransStat_MAX_WEQGRAPH_SIZE : 0 TransStat_MAX_SIZEOF_WEQEDGELABEL : 0 TransStat_NO_SUPPORTING_EQUALITIES : 929 TransStat_NO_SUPPORTING_DISEQUALITIES : 156 TransStat_NO_DISJUNCTIONS : 581 TransStat_MAX_NO_DISJUNCTIONS : 4 - StatisticsResult: EqConstraintFactoryStatistics CONJOIN_DISJUNCTIVE(MILLISECONDS) : 0.426424 RENAME_VARIABLES(MILLISECONDS) : 0.003794 UNFREEZE(MILLISECONDS) : 0.000000 CONJOIN(MILLISECONDS) : 0.193716 PROJECTAWAY(MILLISECONDS) : 0.796740 ADD_WEAK_EQUALITY(MILLISECONDS) : 0.002317 DISJOIN(MILLISECONDS) : 0.365577 RENAME_VARIABLES_DISJUNCTIVE(MILLISECONDS) : 0.016047 ADD_EQUALITY(MILLISECONDS) : 0.013856 DISJOIN_DISJUNCTIVE(MILLISECONDS) : 0.000000 ADD_DISEQUALITY(MILLISECONDS) : 0.008548 #CONJOIN_DISJUNCTIVE : 3040 #RENAME_VARIABLES : 7690 #UNFREEZE : 0 #CONJOIN : 6145 #PROJECTAWAY : 5026 #ADD_WEAK_EQUALITY : 213 #DISJOIN : 1595 #RENAME_VARIABLES_DISJUNCTIVE : 6977 #ADD_EQUALITY : 984 #DISJOIN_DISJUNCTIVE : 0 #ADD_DISEQUALITY : 134 - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] FCALL (&ldv_global_msg_list)->next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] FCALL (msg)->list.next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] FCALL (msg)->list.next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] FCALL entry->prev - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] FCALL entry->prev [L1131] FCALL entry->next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND TRUE !cfg [L1613] FCALL free(client) [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] FCALL (&ldv_global_msg_list)->next - UnprovableResult [Line: 1619]: Unable to prove that all allocated memory was freed Unable to prove that all allocated memory was freed Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND FALSE !(&msg->list != (&ldv_global_msg_list)) [L1615] FCALL ldv_destroy_msgs() - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] FCALL prev->next = next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] FCALL prev->next = next - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND TRUE !fe [L1611] FCALL free(cfg) [L1613] FCALL free(client) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] RET, FCALL prev->next = next [L1131] RET __ldv_list_del(entry->prev, entry->next) [L1180] ldv_list_del(&msg->list) [L1182] CALL ldv_msg_free(msg) [L1162] COND TRUE \read(*msg) [L1163] FCALL msg->data - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] RET, FCALL prev->next = next [L1131] RET __ldv_list_del(entry->prev, entry->next) [L1180] ldv_list_del(&msg->list) [L1182] CALL ldv_msg_free(msg) [L1162] COND TRUE \read(*msg) [L1163] EXPR, FCALL msg->data [L1163] FCALL free(msg->data) - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] RET, FCALL prev->next = next [L1131] RET __ldv_list_del(entry->prev, entry->next) [L1180] ldv_list_del(&msg->list) [L1182] CALL ldv_msg_free(msg) [L1162] COND TRUE \read(*msg) [L1163] EXPR, FCALL msg->data [L1163] FCALL free(msg->data) - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] RET, FCALL prev->next = next [L1131] RET __ldv_list_del(entry->prev, entry->next) [L1180] ldv_list_del(&msg->list) [L1182] CALL ldv_msg_free(msg) [L1162] COND TRUE \read(*msg) [L1163] EXPR, FCALL msg->data [L1163] FCALL free(msg->data) [L1164] FCALL free(msg) - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] RET, FCALL prev->next = next [L1131] RET __ldv_list_del(entry->prev, entry->next) [L1180] ldv_list_del(&msg->list) [L1182] CALL ldv_msg_free(msg) [L1162] COND TRUE \read(*msg) [L1163] EXPR, FCALL msg->data [L1163] FCALL free(msg->data) [L1164] FCALL free(msg) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] RET, FCALL prev->next = next [L1131] RET __ldv_list_del(entry->prev, entry->next) [L1180] ldv_list_del(&msg->list) [L1182] CALL ldv_msg_free(msg) [L1162] COND FALSE, RET !(\read(*msg)) [L1182] ldv_msg_free(msg) [L1179] msg = n [L1179] FCALL (n)->list.next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND TRUE !client [L1615] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] RET, FCALL prev->next = next [L1131] RET __ldv_list_del(entry->prev, entry->next) [L1180] ldv_list_del(&msg->list) [L1182] CALL ldv_msg_free(msg) [L1162] COND FALSE, RET !(\read(*msg)) [L1182] ldv_msg_free(msg) [L1179] msg = n [L1179] FCALL (n)->list.next - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND TRUE !addr [L1609] FCALL free(fe) [L1611] FCALL free(cfg) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND TRUE !adapter [L1607] FCALL free(addr) [L1609] FCALL free(fe) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] FCALL client->dev.platform_data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] FCALL client->dev.platform_data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] FCALL cfg->fe - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] FCALL cfg->fe - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL, EXPR alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND TRUE !priv [L1544] ret=- -3 [L1563] FCALL free(priv) [L1565] return ret; [L1565] RET return ret; [L1601] EXPR alloc_12(client) [L1601] COND FALSE !(alloc_12(client)==0) [L1605] FCALL free(adapter) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL, EXPR alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND TRUE !priv [L1544] ret=- -3 [L1563] FCALL free(priv) [L1565] return ret; [L1565] RET return ret; [L1601] EXPR alloc_12(client) [L1601] COND FALSE !(alloc_12(client)==0) [L1605] FCALL free(adapter) [L1607] FCALL free(addr) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] FCALL priv->client - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] FCALL priv->client - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] FCALL priv->client->addr - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] FCALL priv->client->addr - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] FCALL priv->client - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] FCALL priv->client->addr - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] FCALL priv->client->addr - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] FCALL priv->client - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] FCALL priv->client->adapter - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] FCALL priv->client->adapter - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] FCALL adap->master_xfer - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] FCALL adap->master_xfer - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] FCALL list->prev = list - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND FALSE !(ret == 2) [L1533] ret = -1 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND TRUE \read(ret) [L1563] FCALL free(priv) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] FCALL i2c_msg[i].buf - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] FCALL i2c_msg[i].buf - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] FCALL i2c_msg[i].buf [L1490] FCALL i2c_msg[i].len - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] FCALL head->next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] FCALL head->next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] FCALL prev->next = new - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND FALSE !(\read(*msg)) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND TRUE !data [L1155] RET return - -3; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND TRUE \read(ret) [L1499] CALL ldv_msg_free(m) [L1162] COND TRUE \read(*msg) [L1163] FCALL msg->data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1559] FCALL fe->tuner_priv = priv - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1559] FCALL fe->tuner_priv = priv - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND FALSE !(\read(*msg)) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND TRUE !data [L1155] RET return - -3; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1559] FCALL fe->tuner_priv = priv [L1560] CALL ldv_i2c_set_clientdata(client, priv) [L1462] CALL ldv_dev_set_drvdata(&dev->dev, data) [L1198] FCALL dev->driver_data = data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1559] FCALL fe->tuner_priv = priv [L1560] CALL ldv_i2c_set_clientdata(client, priv) [L1462] CALL ldv_dev_set_drvdata(&dev->dev, data) [L1198] FCALL dev->driver_data = data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL, EXPR alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1555] default: [L1563] FCALL free(priv) [L1565] return ret; [L1565] RET return ret; [L1601] EXPR alloc_12(client) [L1601] COND TRUE alloc_12(client)==0 [L1602] CALL free_12(client) [L1569] FCALL client->dev.platform_data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL, EXPR alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1555] default: [L1563] FCALL free(priv) [L1565] return ret; [L1565] RET return ret; [L1601] EXPR alloc_12(client) [L1601] COND TRUE alloc_12(client)==0 [L1602] CALL free_12(client) [L1569] FCALL client->dev.platform_data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL, EXPR alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1555] default: [L1563] FCALL free(priv) [L1565] return ret; [L1565] RET return ret; [L1601] EXPR alloc_12(client) [L1601] COND TRUE alloc_12(client)==0 [L1602] CALL free_12(client) [L1569] EXPR, FCALL client->dev.platform_data [L1569] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1570] FCALL cfg->fe - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL, EXPR alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1555] default: [L1563] FCALL free(priv) [L1565] return ret; [L1565] RET return ret; [L1601] EXPR alloc_12(client) [L1601] COND TRUE alloc_12(client)==0 [L1602] CALL free_12(client) [L1569] EXPR, FCALL client->dev.platform_data [L1569] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1570] FCALL cfg->fe - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL, EXPR alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1555] default: [L1563] FCALL free(priv) [L1565] return ret; [L1565] RET return ret; [L1601] EXPR alloc_12(client) [L1601] COND TRUE alloc_12(client)==0 [L1602] CALL free_12(client) [L1569] EXPR, FCALL client->dev.platform_data [L1569] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1570] EXPR, FCALL cfg->fe [L1570] struct ldv_dvb_frontend *fe = cfg->fe; [L1571] FCALL fe->tuner_priv = 0 - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL, EXPR alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1555] default: [L1563] FCALL free(priv) [L1565] return ret; [L1565] RET return ret; [L1601] EXPR alloc_12(client) [L1601] COND TRUE alloc_12(client)==0 [L1602] CALL free_12(client) [L1569] EXPR, FCALL client->dev.platform_data [L1569] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1570] EXPR, FCALL cfg->fe [L1570] struct ldv_dvb_frontend *fe = cfg->fe; [L1571] FCALL fe->tuner_priv = 0 - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL, EXPR alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1555] default: [L1563] FCALL free(priv) [L1565] return ret; [L1565] RET return ret; [L1601] EXPR alloc_12(client) [L1601] COND TRUE alloc_12(client)==0 [L1602] CALL free_12(client) [L1569] EXPR, FCALL client->dev.platform_data [L1569] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1570] EXPR, FCALL cfg->fe [L1570] struct ldv_dvb_frontend *fe = cfg->fe; [L1571] FCALL fe->tuner_priv = 0 [L1572] CALL ldv_i2c_get_clientdata(client) [L1457] CALL ldv_dev_get_drvdata(&dev->dev) [L1193] FCALL dev->driver_data - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL, EXPR alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1555] default: [L1563] FCALL free(priv) [L1565] return ret; [L1565] RET return ret; [L1601] EXPR alloc_12(client) [L1601] COND TRUE alloc_12(client)==0 [L1602] CALL free_12(client) [L1569] EXPR, FCALL client->dev.platform_data [L1569] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1570] EXPR, FCALL cfg->fe [L1570] struct ldv_dvb_frontend *fe = cfg->fe; [L1571] FCALL fe->tuner_priv = 0 [L1572] CALL, EXPR ldv_i2c_get_clientdata(client) [L1457] CALL, EXPR ldv_dev_get_drvdata(&dev->dev) [L1193] EXPR, FCALL dev->driver_data [L1193] RET return dev->driver_data; [L1457] EXPR ldv_dev_get_drvdata(&dev->dev) [L1457] RET return ldv_dev_get_drvdata(&dev->dev); [L1572] EXPR ldv_i2c_get_clientdata(client) [L1572] void *priv = (struct ldv_m88ts2022_priv *)ldv_i2c_get_clientdata(client); [L1573] COND TRUE \read(*priv) [L1574] FCALL free(priv) - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1620] CALL entry_point() [L1579] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1579] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1579] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1580] COND FALSE !(!client) [L1582] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1582] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1581-L1582] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1583] COND FALSE !(!cfg) [L1584] FCALL client->dev.platform_data = cfg [L1586] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1586] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1585-L1586] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1587] COND FALSE !(!fe) [L1588] FCALL cfg->fe = fe [L1590] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1590] EXPR ldv_malloc(sizeof(int)) [L1590] void *addr = (void *)ldv_malloc(sizeof(int)); [L1591] COND FALSE !(!addr) [L1592] FCALL client->addr = addr [L1595] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1595] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1594-L1595] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1596] COND FALSE !(!adapter) [L1597] FCALL client->adapter = adapter [L1599] FCALL adapter->master_xfer = master_xfer [L1601] CALL, EXPR alloc_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1555] default: [L1563] FCALL free(priv) [L1565] return ret; [L1565] RET return ret; [L1601] EXPR alloc_12(client) [L1601] COND TRUE alloc_12(client)==0 [L1602] CALL free_12(client) [L1569] EXPR, FCALL client->dev.platform_data [L1569] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1570] EXPR, FCALL cfg->fe [L1570] struct ldv_dvb_frontend *fe = cfg->fe; [L1571] FCALL fe->tuner_priv = 0 [L1572] CALL, EXPR ldv_i2c_get_clientdata(client) [L1457] CALL, EXPR ldv_dev_get_drvdata(&dev->dev) [L1193] EXPR, FCALL dev->driver_data [L1193] RET return dev->driver_data; [L1457] EXPR ldv_dev_get_drvdata(&dev->dev) [L1457] RET return ldv_dev_get_drvdata(&dev->dev); [L1572] EXPR ldv_i2c_get_clientdata(client) [L1572] void *priv = (struct ldv_m88ts2022_priv *)ldv_i2c_get_clientdata(client); [L1573] COND TRUE \read(*priv) [L1574] FCALL free(priv) - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: -1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: -1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor: - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification ensures #valid == old(#valid); is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) RESULT: Ultimate could not prove your program: unable to determine feasibility of some traces Written .csv to /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../releaseScripts/default/UAutomizer-linux/csv/memleaks_test12_false-valid-free.i_svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf_AbstractInterpretationC.xml/Csv-Benchmark-0-2018-01-24_16-30-06-395.csv Written .csv to /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../releaseScripts/default/UAutomizer-linux/csv/memleaks_test12_false-valid-free.i_svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf_AbstractInterpretationC.xml/Csv-VPDomainBenchmark-0-2018-01-24_16-30-06-395.csv Written .csv to /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../releaseScripts/default/UAutomizer-linux/csv/memleaks_test12_false-valid-free.i_svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf_AbstractInterpretationC.xml/Csv-BenchmarkWithCounters-0-2018-01-24_16-30-06-395.csv Received shutdown request...