java -Xmx6000000000 -jar ./plugins/org.eclipse.equinox.launcher_1.3.100.v20150511-1540.jar -data ./data --generate-csv --csv-dir ../../../releaseScripts/default/UAutomizer-linux/csv -tc ../../../trunk/examples/toolchains/AbstractInterpretationC.xml -s ../../../trunk/examples/settings/ai/eq-bench/svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf -i ../../../trunk/examples/svcomp/ldv-memsafety/memleaks_test12_true-valid-memsafety.i -------------------------------------------------------------------------------- This is Ultimate 0.1.23-6b94a2f [2018-01-24 16:31:00,854 INFO L170 SettingsManager]: Resetting all preferences to default values... [2018-01-24 16:31:00,868 INFO L174 SettingsManager]: Resetting UltimateCore preferences to default values [2018-01-24 16:31:00,881 INFO L177 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2018-01-24 16:31:00,881 INFO L174 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2018-01-24 16:31:00,882 INFO L174 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2018-01-24 16:31:00,883 INFO L174 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2018-01-24 16:31:00,885 INFO L174 SettingsManager]: Resetting LassoRanker preferences to default values [2018-01-24 16:31:00,887 INFO L174 SettingsManager]: Resetting Reaching Definitions preferences to default values [2018-01-24 16:31:00,888 INFO L174 SettingsManager]: Resetting SyntaxChecker preferences to default values [2018-01-24 16:31:00,889 INFO L177 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2018-01-24 16:31:00,889 INFO L174 SettingsManager]: Resetting LTL2Aut preferences to default values [2018-01-24 16:31:00,890 INFO L174 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2018-01-24 16:31:00,890 INFO L174 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2018-01-24 16:31:00,891 INFO L174 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2018-01-24 16:31:00,893 INFO L174 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2018-01-24 16:31:00,896 INFO L174 SettingsManager]: Resetting CodeCheck preferences to default values [2018-01-24 16:31:00,898 INFO L174 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2018-01-24 16:31:00,899 INFO L174 SettingsManager]: Resetting RCFGBuilder preferences to default values [2018-01-24 16:31:00,900 INFO L174 SettingsManager]: Resetting TraceAbstraction preferences to default values [2018-01-24 16:31:00,902 INFO L177 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2018-01-24 16:31:00,903 INFO L177 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2018-01-24 16:31:00,903 INFO L174 SettingsManager]: Resetting IcfgTransformer preferences to default values [2018-01-24 16:31:00,904 INFO L174 SettingsManager]: Resetting Boogie Printer preferences to default values [2018-01-24 16:31:00,905 INFO L174 SettingsManager]: Resetting Witness Printer preferences to default values [2018-01-24 16:31:00,906 INFO L177 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2018-01-24 16:31:00,907 INFO L174 SettingsManager]: Resetting CDTParser preferences to default values [2018-01-24 16:31:00,907 INFO L177 SettingsManager]: PEA to Boogie provides no preferences, ignoring... [2018-01-24 16:31:00,908 INFO L177 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2018-01-24 16:31:00,908 INFO L174 SettingsManager]: Resetting Witness Parser preferences to default values [2018-01-24 16:31:00,908 INFO L181 SettingsManager]: Finished resetting all preferences to default values... [2018-01-24 16:31:00,909 INFO L98 SettingsManager]: Beginning loading settings from /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../trunk/examples/settings/ai/eq-bench/svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf [2018-01-24 16:31:00,919 INFO L110 SettingsManager]: Loading preferences was successful [2018-01-24 16:31:00,919 INFO L112 SettingsManager]: Preferences different from defaults after loading the file: [2018-01-24 16:31:00,920 INFO L131 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2018-01-24 16:31:00,920 INFO L133 SettingsManager]: * to procedures, called more than once=true [2018-01-24 16:31:00,921 INFO L131 SettingsManager]: Preferences of Abstract Interpretation differ from their defaults: [2018-01-24 16:31:00,921 INFO L133 SettingsManager]: * Deactivate Weak Equivalences=true [2018-01-24 16:31:00,921 INFO L133 SettingsManager]: * Abstract domain for RCFG-of-the-future=VPDomain [2018-01-24 16:31:00,921 INFO L133 SettingsManager]: * Use the RCFG-of-the-future interface=true [2018-01-24 16:31:00,922 INFO L131 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2018-01-24 16:31:00,922 INFO L133 SettingsManager]: * sizeof long=4 [2018-01-24 16:31:00,922 INFO L133 SettingsManager]: * Check unreachability of error function in SV-COMP mode=false [2018-01-24 16:31:00,923 INFO L133 SettingsManager]: * Overapproximate operations on floating types=true [2018-01-24 16:31:00,923 INFO L133 SettingsManager]: * sizeof POINTER=4 [2018-01-24 16:31:00,923 INFO L133 SettingsManager]: * Check division by zero=IGNORE [2018-01-24 16:31:00,923 INFO L133 SettingsManager]: * Check for the main procedure if all allocated memory was freed=true [2018-01-24 16:31:00,923 INFO L133 SettingsManager]: * Bitprecise bitfields=true [2018-01-24 16:31:00,924 INFO L133 SettingsManager]: * SV-COMP memtrack compatibility mode=true [2018-01-24 16:31:00,924 INFO L133 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2018-01-24 16:31:00,924 INFO L133 SettingsManager]: * sizeof long double=12 [2018-01-24 16:31:00,924 INFO L131 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2018-01-24 16:31:00,924 INFO L133 SettingsManager]: * Size of a code block=SequenceOfStatements [2018-01-24 16:31:00,925 INFO L133 SettingsManager]: * To the following directory=./dump/ [2018-01-24 16:31:00,925 INFO L133 SettingsManager]: * Add additional assume for each assert=false [2018-01-24 16:31:00,925 INFO L133 SettingsManager]: * SMT solver=External_DefaultMode [2018-01-24 16:31:00,925 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-01-24 16:31:00,925 INFO L131 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2018-01-24 16:31:00,926 INFO L133 SettingsManager]: * Interpolant automaton=TWOTRACK [2018-01-24 16:31:00,926 INFO L133 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2018-01-24 16:31:00,926 INFO L133 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2018-01-24 16:31:00,926 INFO L133 SettingsManager]: * Trace refinement strategy=CAMEL [2018-01-24 16:31:00,926 INFO L133 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2018-01-24 16:31:00,927 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in [2018-01-24 16:31:00,927 INFO L133 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2018-01-24 16:31:00,928 INFO L131 SettingsManager]: Preferences of IcfgTransformer differ from their defaults: [2018-01-24 16:31:00,928 INFO L133 SettingsManager]: * TransformationType=HEAP_SEPARATOR [2018-01-24 16:31:00,962 INFO L81 nceAwareModelManager]: Repository-Root is: /tmp [2018-01-24 16:31:00,975 INFO L266 ainManager$Toolchain]: [Toolchain 1]: Parser(s) successfully initialized [2018-01-24 16:31:00,980 INFO L222 ainManager$Toolchain]: [Toolchain 1]: Toolchain data selected. [2018-01-24 16:31:00,981 INFO L271 PluginConnector]: Initializing CDTParser... [2018-01-24 16:31:00,982 INFO L276 PluginConnector]: CDTParser initialized [2018-01-24 16:31:00,983 INFO L431 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../trunk/examples/svcomp/ldv-memsafety/memleaks_test12_true-valid-memsafety.i [2018-01-24 16:31:01,203 INFO L304 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2018-01-24 16:31:01,209 INFO L131 ToolchainWalker]: Walking toolchain with 4 elements. [2018-01-24 16:31:01,210 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2018-01-24 16:31:01,210 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2018-01-24 16:31:01,217 INFO L276 PluginConnector]: CACSL2BoogieTranslator initialized [2018-01-24 16:31:01,218 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 24.01 04:31:01" (1/1) ... [2018-01-24 16:31:01,221 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@2b6fdad6 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:31:01, skipping insertion in model container [2018-01-24 16:31:01,221 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 24.01 04:31:01" (1/1) ... [2018-01-24 16:31:01,237 INFO L153 Dispatcher]: Using SV-COMP mode [2018-01-24 16:31:01,286 INFO L153 Dispatcher]: Using SV-COMP mode [2018-01-24 16:31:01,438 INFO L450 PostProcessor]: Settings: Checked method=main [2018-01-24 16:31:01,476 INFO L450 PostProcessor]: Settings: Checked method=main [2018-01-24 16:31:01,493 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:31:01 WrapperNode [2018-01-24 16:31:01,493 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2018-01-24 16:31:01,494 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2018-01-24 16:31:01,494 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2018-01-24 16:31:01,494 INFO L276 PluginConnector]: Boogie Preprocessor initialized [2018-01-24 16:31:01,511 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:31:01" (1/1) ... [2018-01-24 16:31:01,511 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:31:01" (1/1) ... [2018-01-24 16:31:01,524 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:31:01" (1/1) ... [2018-01-24 16:31:01,525 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:31:01" (1/1) ... [2018-01-24 16:31:01,535 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:31:01" (1/1) ... [2018-01-24 16:31:01,539 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:31:01" (1/1) ... [2018-01-24 16:31:01,541 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:31:01" (1/1) ... [2018-01-24 16:31:01,545 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2018-01-24 16:31:01,546 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2018-01-24 16:31:01,546 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2018-01-24 16:31:01,546 INFO L276 PluginConnector]: RCFGBuilder initialized [2018-01-24 16:31:01,547 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 24.01 04:31:01" (1/1) ... No working directory specified, using /storage/ultimate/releaseScripts/default/UAutomizer-linux/z3 Starting monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-01-24 16:31:01,591 INFO L136 BoogieDeclarations]: Found implementation of procedure ULTIMATE.init [2018-01-24 16:31:01,592 INFO L136 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2018-01-24 16:31:01,592 INFO L136 BoogieDeclarations]: Found implementation of procedure ##fun~$Pointer$~X~$Pointer$~X~int~TO~int [2018-01-24 16:31:01,592 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2018-01-24 16:31:01,592 INFO L136 BoogieDeclarations]: Found implementation of procedure LDV_INIT_LIST_HEAD [2018-01-24 16:31:01,592 INFO L136 BoogieDeclarations]: Found implementation of procedure __ldv_list_add [2018-01-24 16:31:01,592 INFO L136 BoogieDeclarations]: Found implementation of procedure __ldv_list_del [2018-01-24 16:31:01,592 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_list_add [2018-01-24 16:31:01,593 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_list_del [2018-01-24 16:31:01,593 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_msg_alloc [2018-01-24 16:31:01,593 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_msg_fill [2018-01-24 16:31:01,593 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_msg_free [2018-01-24 16:31:01,593 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_submit_msg [2018-01-24 16:31:01,593 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_destroy_msgs [2018-01-24 16:31:01,594 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_dev_get_drvdata [2018-01-24 16:31:01,594 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_dev_set_drvdata [2018-01-24 16:31:01,594 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_kobject_cleanup [2018-01-24 16:31:01,594 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_kobject_release [2018-01-24 16:31:01,594 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_i2c_get_clientdata [2018-01-24 16:31:01,594 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_i2c_set_clientdata [2018-01-24 16:31:01,595 INFO L136 BoogieDeclarations]: Found implementation of procedure master_xfer [2018-01-24 16:31:01,595 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_i2c_transfer [2018-01-24 16:31:01,595 INFO L136 BoogieDeclarations]: Found implementation of procedure ldv_m88ts2022_rd_reg [2018-01-24 16:31:01,595 INFO L136 BoogieDeclarations]: Found implementation of procedure alloc_fix_12 [2018-01-24 16:31:01,595 INFO L136 BoogieDeclarations]: Found implementation of procedure free_12 [2018-01-24 16:31:01,596 INFO L136 BoogieDeclarations]: Found implementation of procedure entry_point [2018-01-24 16:31:01,596 INFO L136 BoogieDeclarations]: Found implementation of procedure main [2018-01-24 16:31:01,596 INFO L128 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2018-01-24 16:31:01,596 INFO L128 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2018-01-24 16:31:01,596 INFO L128 BoogieDeclarations]: Found specification of procedure write~int [2018-01-24 16:31:01,596 INFO L128 BoogieDeclarations]: Found specification of procedure read~int [2018-01-24 16:31:01,597 INFO L128 BoogieDeclarations]: Found specification of procedure ULTIMATE.free [2018-01-24 16:31:01,597 INFO L128 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2018-01-24 16:31:01,597 INFO L128 BoogieDeclarations]: Found specification of procedure #Ultimate.alloc [2018-01-24 16:31:01,597 INFO L128 BoogieDeclarations]: Found specification of procedure #Ultimate.C_memcpy [2018-01-24 16:31:01,597 INFO L136 BoogieDeclarations]: Found implementation of procedure #Ultimate.C_memcpy [2018-01-24 16:31:01,597 INFO L128 BoogieDeclarations]: Found specification of procedure malloc [2018-01-24 16:31:01,597 INFO L128 BoogieDeclarations]: Found specification of procedure free [2018-01-24 16:31:01,598 INFO L128 BoogieDeclarations]: Found specification of procedure __VERIFIER_nondet_int [2018-01-24 16:31:01,598 INFO L128 BoogieDeclarations]: Found specification of procedure memcpy [2018-01-24 16:31:01,598 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_malloc [2018-01-24 16:31:01,598 INFO L128 BoogieDeclarations]: Found specification of procedure LDV_INIT_LIST_HEAD [2018-01-24 16:31:01,598 INFO L128 BoogieDeclarations]: Found specification of procedure __ldv_list_add [2018-01-24 16:31:01,599 INFO L128 BoogieDeclarations]: Found specification of procedure __ldv_list_del [2018-01-24 16:31:01,599 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_list_add [2018-01-24 16:31:01,599 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_list_del [2018-01-24 16:31:01,599 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_msg_alloc [2018-01-24 16:31:01,599 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_msg_fill [2018-01-24 16:31:01,599 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_msg_free [2018-01-24 16:31:01,599 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_submit_msg [2018-01-24 16:31:01,599 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_destroy_msgs [2018-01-24 16:31:01,599 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_dev_get_drvdata [2018-01-24 16:31:01,599 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_dev_set_drvdata [2018-01-24 16:31:01,600 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_kobject_cleanup [2018-01-24 16:31:01,600 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_kobject_release [2018-01-24 16:31:01,600 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_i2c_get_clientdata [2018-01-24 16:31:01,600 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_i2c_set_clientdata [2018-01-24 16:31:01,600 INFO L128 BoogieDeclarations]: Found specification of procedure master_xfer [2018-01-24 16:31:01,600 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_i2c_transfer [2018-01-24 16:31:01,600 INFO L128 BoogieDeclarations]: Found specification of procedure ##fun~$Pointer$~X~$Pointer$~X~int~TO~int [2018-01-24 16:31:01,600 INFO L128 BoogieDeclarations]: Found specification of procedure ldv_m88ts2022_rd_reg [2018-01-24 16:31:01,601 INFO L128 BoogieDeclarations]: Found specification of procedure alloc_fix_12 [2018-01-24 16:31:01,601 INFO L128 BoogieDeclarations]: Found specification of procedure free_12 [2018-01-24 16:31:01,601 INFO L128 BoogieDeclarations]: Found specification of procedure entry_point [2018-01-24 16:31:01,601 INFO L128 BoogieDeclarations]: Found specification of procedure main [2018-01-24 16:31:01,601 INFO L128 BoogieDeclarations]: Found specification of procedure ULTIMATE.init [2018-01-24 16:31:01,601 INFO L128 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2018-01-24 16:31:02,562 WARN L455 $ProcedureCfgBuilder]: Label in the middle of a codeblock. [2018-01-24 16:31:02,677 INFO L257 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2018-01-24 16:31:02,678 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 24.01 04:31:02 BoogieIcfgContainer [2018-01-24 16:31:02,678 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2018-01-24 16:31:02,679 INFO L113 PluginConnector]: ------------------------Abstract Interpretation---------------------------- [2018-01-24 16:31:02,679 INFO L271 PluginConnector]: Initializing Abstract Interpretation... [2018-01-24 16:31:02,679 INFO L276 PluginConnector]: Abstract Interpretation initialized [2018-01-24 16:31:02,680 INFO L185 PluginConnector]: Executing the observer AbstractInterpretationRcfgObserver from plugin Abstract Interpretation for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 24.01 04:31:02" (1/1) ... [2018-01-24 16:31:02,745 INFO L101 FixpointEngine]: Starting fixpoint engine with domain VPDomain (maxUnwinding=3, maxParallelStates=2) [2018-01-24 16:31:09,375 INFO L259 AbstractInterpreter]: Some error location(s) were reachable [2018-01-24 16:31:09,398 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification ensures #valid == old(#valid); is not ensure(true) [2018-01-24 16:31:09,735 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,739 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,742 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,744 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,745 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,747 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,748 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,750 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,752 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,753 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,755 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,757 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,758 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,760 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,761 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,762 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,763 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,764 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,766 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,767 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,768 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,769 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,771 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,774 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,775 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,777 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,779 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,781 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,782 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,784 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,786 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,788 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,790 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,790 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,792 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,792 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,793 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,794 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,796 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,796 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,798 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,798 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,800 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,800 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,802 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,803 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,805 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,805 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,807 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,807 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,809 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,810 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,812 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,812 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,814 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,814 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,817 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,817 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,820 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,820 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,820 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,822 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,823 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,823 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,825 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,825 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,828 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,828 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,828 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,830 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,831 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,831 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,833 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,833 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,837 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,837 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,838 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,840 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,840 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,841 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,843 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,843 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,844 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,846 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,846 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,846 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,848 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,849 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,849 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,851 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,851 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,852 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,854 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,854 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,854 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,857 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,857 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,857 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,860 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,860 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,861 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,865 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,865 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,865 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,869 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,870 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,870 WARN L343 cessorBacktranslator]: Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) [2018-01-24 16:31:09,875 INFO L268 AbstractInterpreter]: Visited 433 different actions 1756 times. Merged at 121 different actions 465 times. Widened at 3 different actions 3 times. Found 77 fixpoints after 35 different actions. Largest state had 54 variables. [2018-01-24 16:31:09,878 INFO L132 PluginConnector]: ------------------------ END Abstract Interpretation---------------------------- [2018-01-24 16:31:09,880 INFO L168 Benchmark]: Toolchain (without parser) took 8676.42 ms. Allocated memory was 306.7 MB in the beginning and 1.2 GB in the end (delta: 940.6 MB). Free memory was 265.8 MB in the beginning and 1.1 GB in the end (delta: -852.9 MB). Peak memory consumption was 188.7 MB. Max. memory is 5.3 GB. [2018-01-24 16:31:09,881 INFO L168 Benchmark]: CDTParser took 0.17 ms. Allocated memory is still 306.7 MB. Free memory is still 272.8 MB. There was no memory consumed. Max. memory is 5.3 GB. [2018-01-24 16:31:09,881 INFO L168 Benchmark]: CACSL2BoogieTranslator took 283.29 ms. Allocated memory is still 306.7 MB. Free memory was 265.8 MB in the beginning and 248.8 MB in the end (delta: 17.0 MB). Peak memory consumption was 17.0 MB. Max. memory is 5.3 GB. [2018-01-24 16:31:09,881 INFO L168 Benchmark]: Boogie Preprocessor took 51.59 ms. Allocated memory is still 306.7 MB. Free memory was 248.8 MB in the beginning and 245.8 MB in the end (delta: 3.0 MB). Peak memory consumption was 3.0 MB. Max. memory is 5.3 GB. [2018-01-24 16:31:09,881 INFO L168 Benchmark]: RCFGBuilder took 1132.43 ms. Allocated memory was 306.7 MB in the beginning and 328.7 MB in the end (delta: 22.0 MB). Free memory was 245.8 MB in the beginning and 263.4 MB in the end (delta: -17.6 MB). Peak memory consumption was 69.2 MB. Max. memory is 5.3 GB. [2018-01-24 16:31:09,882 INFO L168 Benchmark]: Abstract Interpretation took 7199.78 ms. Allocated memory was 328.7 MB in the beginning and 1.2 GB in the end (delta: 918.6 MB). Free memory was 263.4 MB in the beginning and 1.1 GB in the end (delta: -855.3 MB). Peak memory consumption was 164.3 MB. Max. memory is 5.3 GB. [2018-01-24 16:31:09,884 INFO L344 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.17 ms. Allocated memory is still 306.7 MB. Free memory is still 272.8 MB. There was no memory consumed. Max. memory is 5.3 GB. * CACSL2BoogieTranslator took 283.29 ms. Allocated memory is still 306.7 MB. Free memory was 265.8 MB in the beginning and 248.8 MB in the end (delta: 17.0 MB). Peak memory consumption was 17.0 MB. Max. memory is 5.3 GB. * Boogie Preprocessor took 51.59 ms. Allocated memory is still 306.7 MB. Free memory was 248.8 MB in the beginning and 245.8 MB in the end (delta: 3.0 MB). Peak memory consumption was 3.0 MB. Max. memory is 5.3 GB. * RCFGBuilder took 1132.43 ms. Allocated memory was 306.7 MB in the beginning and 328.7 MB in the end (delta: 22.0 MB). Free memory was 245.8 MB in the beginning and 263.4 MB in the end (delta: -17.6 MB). Peak memory consumption was 69.2 MB. Max. memory is 5.3 GB. * Abstract Interpretation took 7199.78 ms. Allocated memory was 328.7 MB in the beginning and 1.2 GB in the end (delta: 918.6 MB). Free memory was 263.4 MB in the beginning and 1.1 GB in the end (delta: -855.3 MB). Peak memory consumption was 164.3 MB. Max. memory is 5.3 GB. * Results from de.uni_freiburg.informatik.ultimate.plugins.analysis.abstractinterpretationv2: - StatisticsResult: ArrayEqualityDomainStatistics #Locations : 365 LocStat_MAX_WEQGRAPH_SIZE : 0 LocStat_MAX_SIZEOF_WEQEDGELABEL : 0 LocStat_NO_SUPPORTING_EQUALITIES : 4278 LocStat_NO_SUPPORTING_DISEQUALITIES : 2439 LocStat_NO_DISJUNCTIONS : -730 LocStat_MAX_NO_DISJUNCTIONS : -1 #Transitions : 483 TransStat_MAX_WEQGRAPH_SIZE : 0 TransStat_MAX_SIZEOF_WEQEDGELABEL : 0 TransStat_NO_SUPPORTING_EQUALITIES : 930 TransStat_NO_SUPPORTING_DISEQUALITIES : 156 TransStat_NO_DISJUNCTIONS : 581 TransStat_MAX_NO_DISJUNCTIONS : 4 - StatisticsResult: EqConstraintFactoryStatistics CONJOIN_DISJUNCTIVE(MILLISECONDS) : 0.306858 RENAME_VARIABLES(MILLISECONDS) : 0.002292 UNFREEZE(MILLISECONDS) : 0.000000 CONJOIN(MILLISECONDS) : 0.133143 PROJECTAWAY(MILLISECONDS) : 0.573359 ADD_WEAK_EQUALITY(MILLISECONDS) : 0.001454 DISJOIN(MILLISECONDS) : 0.294004 RENAME_VARIABLES_DISJUNCTIVE(MILLISECONDS) : 0.008550 ADD_EQUALITY(MILLISECONDS) : 0.005508 DISJOIN_DISJUNCTIVE(MILLISECONDS) : 0.000000 ADD_DISEQUALITY(MILLISECONDS) : 0.006149 #CONJOIN_DISJUNCTIVE : 3001 #RENAME_VARIABLES : 7586 #UNFREEZE : 0 #CONJOIN : 6076 #PROJECTAWAY : 4961 #ADD_WEAK_EQUALITY : 213 #DISJOIN : 1584 #RENAME_VARIABLES_DISJUNCTIVE : 6879 #ADD_EQUALITY : 985 #DISJOIN_DISJUNCTIVE : 0 #ADD_DISEQUALITY : 134 - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] FCALL (&ldv_global_msg_list)->next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] FCALL (msg)->list.next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] FCALL (msg)->list.next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] FCALL entry->prev - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] FCALL entry->prev [L1131] FCALL entry->next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND TRUE !cfg [L1614] FCALL free(client) [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] FCALL (&ldv_global_msg_list)->next - UnprovableResult [Line: 1620]: Unable to prove that all allocated memory was freed Unable to prove that all allocated memory was freed Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND FALSE !(&msg->list != (&ldv_global_msg_list)) [L1616] FCALL ldv_destroy_msgs() - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] FCALL prev->next = next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] FCALL prev->next = next - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND TRUE !fe [L1612] FCALL free(cfg) [L1614] FCALL free(client) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] RET, FCALL prev->next = next [L1131] RET __ldv_list_del(entry->prev, entry->next) [L1180] ldv_list_del(&msg->list) [L1182] CALL ldv_msg_free(msg) [L1162] COND TRUE \read(*msg) [L1163] FCALL msg->data - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] RET, FCALL prev->next = next [L1131] RET __ldv_list_del(entry->prev, entry->next) [L1180] ldv_list_del(&msg->list) [L1182] CALL ldv_msg_free(msg) [L1162] COND TRUE \read(*msg) [L1163] EXPR, FCALL msg->data [L1163] FCALL free(msg->data) - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] RET, FCALL prev->next = next [L1131] RET __ldv_list_del(entry->prev, entry->next) [L1180] ldv_list_del(&msg->list) [L1182] CALL ldv_msg_free(msg) [L1162] COND TRUE \read(*msg) [L1163] EXPR, FCALL msg->data [L1163] FCALL free(msg->data) - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] RET, FCALL prev->next = next [L1131] RET __ldv_list_del(entry->prev, entry->next) [L1180] ldv_list_del(&msg->list) [L1182] CALL ldv_msg_free(msg) [L1162] COND TRUE \read(*msg) [L1163] EXPR, FCALL msg->data [L1163] FCALL free(msg->data) [L1164] FCALL free(msg) - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] RET, FCALL prev->next = next [L1131] RET __ldv_list_del(entry->prev, entry->next) [L1180] ldv_list_del(&msg->list) [L1182] CALL ldv_msg_free(msg) [L1162] COND TRUE \read(*msg) [L1163] EXPR, FCALL msg->data [L1163] FCALL free(msg->data) [L1164] FCALL free(msg) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] RET, FCALL prev->next = next [L1131] RET __ldv_list_del(entry->prev, entry->next) [L1180] ldv_list_del(&msg->list) [L1182] CALL ldv_msg_free(msg) [L1162] COND FALSE, RET !(\read(*msg)) [L1182] ldv_msg_free(msg) [L1179] msg = n [L1179] FCALL (n)->list.next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND TRUE !client [L1616] CALL ldv_destroy_msgs() [L1177] struct ldv_msg *msg; [L1178] struct ldv_msg *n; [L1179] EXPR, FCALL (&ldv_global_msg_list)->next [L1179] const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); [L1179] msg = ({ const typeof( ((typeof(*msg) *)0)->list ) *__mptr = ((&ldv_global_msg_list)->next); (typeof(*msg) *)( (char *)__mptr - ((size_t) &((typeof(*msg) *)0)->list) );}) [L1179] EXPR, FCALL (msg)->list.next [L1179] const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); [L1179] n = ({ const typeof( ((typeof(*(msg)) *)0)->list ) *__mptr = ((msg)->list.next); (typeof(*(msg)) *)( (char *)__mptr - ((size_t) &((typeof(*(msg)) *)0)->list) );}) [L1179] COND TRUE &msg->list != (&ldv_global_msg_list) [L1180] CALL ldv_list_del(&msg->list) [L1131] EXPR, FCALL entry->prev [L1131] EXPR, FCALL entry->next [L1131] CALL __ldv_list_del(entry->prev, entry->next) [L1115] FCALL next->prev = prev [L1116] RET, FCALL prev->next = next [L1131] RET __ldv_list_del(entry->prev, entry->next) [L1180] ldv_list_del(&msg->list) [L1182] CALL ldv_msg_free(msg) [L1162] COND FALSE, RET !(\read(*msg)) [L1182] ldv_msg_free(msg) [L1179] msg = n [L1179] FCALL (n)->list.next - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND TRUE !addr [L1610] FCALL free(fe) [L1612] FCALL free(cfg) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND TRUE !adapter [L1608] FCALL free(addr) [L1610] FCALL free(fe) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] FCALL client->dev.platform_data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] FCALL client->dev.platform_data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] FCALL cfg->fe - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] FCALL cfg->fe - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL, EXPR alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND TRUE !priv [L1544] ret=- -3 [L1564] FCALL free(priv) [L1566] return ret; [L1566] RET return ret; [L1602] EXPR alloc_fix_12(client) [L1602] COND FALSE !(alloc_fix_12(client)==0) [L1606] FCALL free(adapter) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL, EXPR alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND TRUE !priv [L1544] ret=- -3 [L1564] FCALL free(priv) [L1566] return ret; [L1566] RET return ret; [L1602] EXPR alloc_fix_12(client) [L1602] COND FALSE !(alloc_fix_12(client)==0) [L1606] FCALL free(adapter) [L1608] FCALL free(addr) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] FCALL priv->client - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] FCALL priv->client - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] FCALL priv->client->addr - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] FCALL priv->client->addr - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] FCALL priv->client - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] FCALL priv->client->addr - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] FCALL priv->client->addr - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] FCALL priv->client - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] FCALL priv->client->adapter - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] FCALL priv->client->adapter - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] FCALL adap->master_xfer - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] FCALL adap->master_xfer - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] FCALL list->prev = list - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND FALSE !(ret == 2) [L1533] ret = -1 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND TRUE \read(ret) [L1564] FCALL free(priv) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] FCALL i2c_msg[i].buf - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] FCALL i2c_msg[i].buf - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] FCALL i2c_msg[i].buf [L1490] FCALL i2c_msg[i].len - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] FCALL head->next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] FCALL head->next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] FCALL prev->next = new - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) - UnprovableResult [Line: -1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND FALSE !(\read(*msg)) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND TRUE !data [L1155] RET return - -3; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND TRUE \read(ret) [L1499] CALL ldv_msg_free(m) [L1162] COND TRUE \read(*msg) [L1163] FCALL msg->data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1560] FCALL fe->tuner_priv = priv - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1560] FCALL fe->tuner_priv = priv - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND FALSE !(\read(*msg)) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND FALSE !(__VERIFIER_nondet_int()) [L1076] RET return 0; [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND TRUE !data [L1155] RET return - -3; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1560] FCALL fe->tuner_priv = priv [L1561] CALL ldv_i2c_set_clientdata(client, priv) [L1462] CALL ldv_dev_set_drvdata(&dev->dev, data) [L1198] FCALL dev->driver_data = data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1560] FCALL fe->tuner_priv = priv [L1561] CALL ldv_i2c_set_clientdata(client, priv) [L1462] CALL ldv_dev_set_drvdata(&dev->dev, data) [L1198] FCALL dev->driver_data = data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL, EXPR alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1560] FCALL fe->tuner_priv = priv [L1561] CALL ldv_i2c_set_clientdata(client, priv) [L1462] CALL ldv_dev_set_drvdata(&dev->dev, data) [L1198] FCALL dev->driver_data = data [L1462] FCALL ldv_dev_set_drvdata(&dev->dev, data) [L1562] return 0; [L1562] RET return 0; [L1602] EXPR alloc_fix_12(client) [L1602] COND TRUE alloc_fix_12(client)==0 [L1603] CALL free_12(client) [L1570] FCALL client->dev.platform_data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL, EXPR alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1560] FCALL fe->tuner_priv = priv [L1561] CALL ldv_i2c_set_clientdata(client, priv) [L1462] CALL ldv_dev_set_drvdata(&dev->dev, data) [L1198] FCALL dev->driver_data = data [L1462] FCALL ldv_dev_set_drvdata(&dev->dev, data) [L1562] return 0; [L1562] RET return 0; [L1602] EXPR alloc_fix_12(client) [L1602] COND TRUE alloc_fix_12(client)==0 [L1603] CALL free_12(client) [L1570] FCALL client->dev.platform_data - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL, EXPR alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1560] FCALL fe->tuner_priv = priv [L1561] CALL ldv_i2c_set_clientdata(client, priv) [L1462] CALL ldv_dev_set_drvdata(&dev->dev, data) [L1198] FCALL dev->driver_data = data [L1462] FCALL ldv_dev_set_drvdata(&dev->dev, data) [L1562] return 0; [L1562] RET return 0; [L1602] EXPR alloc_fix_12(client) [L1602] COND TRUE alloc_fix_12(client)==0 [L1603] CALL free_12(client) [L1570] EXPR, FCALL client->dev.platform_data [L1570] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1571] FCALL cfg->fe - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL, EXPR alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1560] FCALL fe->tuner_priv = priv [L1561] CALL ldv_i2c_set_clientdata(client, priv) [L1462] CALL ldv_dev_set_drvdata(&dev->dev, data) [L1198] FCALL dev->driver_data = data [L1462] FCALL ldv_dev_set_drvdata(&dev->dev, data) [L1562] return 0; [L1562] RET return 0; [L1602] EXPR alloc_fix_12(client) [L1602] COND TRUE alloc_fix_12(client)==0 [L1603] CALL free_12(client) [L1570] EXPR, FCALL client->dev.platform_data [L1570] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1571] FCALL cfg->fe - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL, EXPR alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1560] FCALL fe->tuner_priv = priv [L1561] CALL ldv_i2c_set_clientdata(client, priv) [L1462] CALL ldv_dev_set_drvdata(&dev->dev, data) [L1198] FCALL dev->driver_data = data [L1462] FCALL ldv_dev_set_drvdata(&dev->dev, data) [L1562] return 0; [L1562] RET return 0; [L1602] EXPR alloc_fix_12(client) [L1602] COND TRUE alloc_fix_12(client)==0 [L1603] CALL free_12(client) [L1570] EXPR, FCALL client->dev.platform_data [L1570] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1571] EXPR, FCALL cfg->fe [L1571] struct ldv_dvb_frontend *fe = cfg->fe; [L1572] FCALL fe->tuner_priv = 0 - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL, EXPR alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1560] FCALL fe->tuner_priv = priv [L1561] CALL ldv_i2c_set_clientdata(client, priv) [L1462] CALL ldv_dev_set_drvdata(&dev->dev, data) [L1198] FCALL dev->driver_data = data [L1462] FCALL ldv_dev_set_drvdata(&dev->dev, data) [L1562] return 0; [L1562] RET return 0; [L1602] EXPR alloc_fix_12(client) [L1602] COND TRUE alloc_fix_12(client)==0 [L1603] CALL free_12(client) [L1570] EXPR, FCALL client->dev.platform_data [L1570] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1571] EXPR, FCALL cfg->fe [L1571] struct ldv_dvb_frontend *fe = cfg->fe; [L1572] FCALL fe->tuner_priv = 0 - UnprovableResult [Line: 1]: Unable to prove that pointer dereference always succeeds Unable to prove that pointer dereference always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL, EXPR alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1560] FCALL fe->tuner_priv = priv [L1561] CALL ldv_i2c_set_clientdata(client, priv) [L1462] CALL ldv_dev_set_drvdata(&dev->dev, data) [L1198] FCALL dev->driver_data = data [L1462] FCALL ldv_dev_set_drvdata(&dev->dev, data) [L1562] return 0; [L1562] RET return 0; [L1602] EXPR alloc_fix_12(client) [L1602] COND TRUE alloc_fix_12(client)==0 [L1603] CALL free_12(client) [L1570] EXPR, FCALL client->dev.platform_data [L1570] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1571] EXPR, FCALL cfg->fe [L1571] struct ldv_dvb_frontend *fe = cfg->fe; [L1572] FCALL fe->tuner_priv = 0 [L1573] CALL ldv_i2c_get_clientdata(client) [L1457] CALL ldv_dev_get_drvdata(&dev->dev) [L1193] FCALL dev->driver_data - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL, EXPR alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1560] FCALL fe->tuner_priv = priv [L1561] CALL ldv_i2c_set_clientdata(client, priv) [L1462] CALL ldv_dev_set_drvdata(&dev->dev, data) [L1198] FCALL dev->driver_data = data [L1462] FCALL ldv_dev_set_drvdata(&dev->dev, data) [L1562] return 0; [L1562] RET return 0; [L1602] EXPR alloc_fix_12(client) [L1602] COND TRUE alloc_fix_12(client)==0 [L1603] CALL free_12(client) [L1570] EXPR, FCALL client->dev.platform_data [L1570] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1571] EXPR, FCALL cfg->fe [L1571] struct ldv_dvb_frontend *fe = cfg->fe; [L1572] FCALL fe->tuner_priv = 0 [L1573] CALL, EXPR ldv_i2c_get_clientdata(client) [L1457] CALL, EXPR ldv_dev_get_drvdata(&dev->dev) [L1193] EXPR, FCALL dev->driver_data [L1193] RET return dev->driver_data; [L1457] EXPR ldv_dev_get_drvdata(&dev->dev) [L1457] RET return ldv_dev_get_drvdata(&dev->dev); [L1573] EXPR ldv_i2c_get_clientdata(client) [L1573] void *priv = (struct ldv_m88ts2022_priv *)ldv_i2c_get_clientdata(client); [L1574] COND TRUE \read(*priv) [L1575] FCALL free(priv) - UnprovableResult [Line: 1]: Unable to prove that free always succeeds Unable to prove that free always succeeds Reason: abstract domain could reach this error location. Possible FailurePath: [L1135] FCALL struct ldv_list_head ldv_global_msg_list = { &(ldv_global_msg_list), &(ldv_global_msg_list) }; [L1621] CALL entry_point() [L1580] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1580] EXPR ldv_malloc(sizeof(struct ldv_i2c_client)) [L1580] struct ldv_i2c_client *client = (struct ldv_i2c_client *)ldv_malloc(sizeof(struct ldv_i2c_client)); [L1581] COND FALSE !(!client) [L1583] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1583] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_config)) [L1582-L1583] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *) ldv_malloc(sizeof(struct ldv_m88ts2022_config)); [L1584] COND FALSE !(!cfg) [L1585] FCALL client->dev.platform_data = cfg [L1587] CALL, EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1587] EXPR ldv_malloc(sizeof(struct ldv_dvb_frontend)) [L1586-L1587] struct ldv_dvb_frontend *fe = (struct ldv_dvb_frontend *) ldv_malloc(sizeof(struct ldv_dvb_frontend)); [L1588] COND FALSE !(!fe) [L1589] FCALL cfg->fe = fe [L1591] CALL, EXPR ldv_malloc(sizeof(int)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1591] EXPR ldv_malloc(sizeof(int)) [L1591] void *addr = (void *)ldv_malloc(sizeof(int)); [L1592] COND FALSE !(!addr) [L1593] FCALL client->addr = addr [L1596] CALL, EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1596] EXPR ldv_malloc(sizeof(struct ldv_i2c_adapter)) [L1595-L1596] struct ldv_i2c_adapter *adapter = (struct ldv_i2c_adapter *) ldv_malloc(sizeof(struct ldv_i2c_adapter)); [L1597] COND FALSE !(!adapter) [L1598] FCALL client->adapter = adapter [L1600] FCALL adapter->master_xfer = master_xfer [L1602] CALL, EXPR alloc_fix_12(client) [L1539] FCALL unsigned char chip_id; [L1540] int ret; [L1541] EXPR, FCALL client->dev.platform_data [L1541] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1542] EXPR, FCALL cfg->fe [L1542] struct ldv_dvb_frontend *fe = cfg->fe; [L1543] CALL, EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1543] EXPR ldv_malloc(sizeof(struct ldv_m88ts2022_priv)) [L1543] struct ldv_m88ts2022_priv *priv = (struct ldv_m88ts2022_priv*)ldv_malloc(sizeof(struct ldv_m88ts2022_priv)); [L1544] COND FALSE !(!priv) [L1545] FCALL memcpy(&priv->cfg, cfg, sizeof(struct ldv_m88ts2022_config)) [L1546] FCALL priv->client = client [L1548] CALL, EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1513] int ret; [L1514] FCALL char buf[1]; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1517] EXPR, FCALL priv->client [L1517] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1522] EXPR, FCALL priv->client [L1522] EXPR, FCALL priv->client->addr [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1528] EXPR, FCALL priv->client [L1528] EXPR, FCALL priv->client->adapter [L1528] CALL, EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1508] EXPR, FCALL adap->master_xfer [L1508] CALL, EXPR adap->master_xfer(adap, msgs, num) [L1484] int ret = - -3; [L1485] struct ldv_msg *m; [L1486] int i=0; [L1487] COND TRUE i < num [L1488] CALL, EXPR ldv_msg_alloc() [L1143] struct ldv_msg *msg; [L1144] CALL, EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1144] EXPR ldv_malloc(sizeof(struct ldv_msg)) [L1144] msg = (struct ldv_msg*)ldv_malloc(sizeof(struct ldv_msg)) [L1145] COND TRUE \read(*msg) [L1146] FCALL msg->data=0 [L1147] CALL LDV_INIT_LIST_HEAD(&msg->list) [L1099] FCALL list->next = list [L1100] RET, FCALL list->prev = list [L1147] LDV_INIT_LIST_HEAD(&msg->list) [L1149] RET return msg; [L1488] EXPR ldv_msg_alloc() [L1488] m = ldv_msg_alloc() [L1489] COND FALSE !(!m) [L1490] EXPR, FCALL i2c_msg[i].buf [L1490] EXPR, FCALL i2c_msg[i].len [L1490] CALL, EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1153] void *data; [L1154] CALL, EXPR ldv_malloc(len) [L1073] COND TRUE __VERIFIER_nondet_int() [L1074] EXPR, FCALL malloc(size) [L1074] RET return malloc(size); [L1154] EXPR ldv_malloc(len) [L1154] data = ldv_malloc(len) [L1155] COND FALSE !(!data) [L1156] FCALL memcpy(data, buf, len) [L1157] FCALL msg->data = data [L1158] RET return 0; [L1490] EXPR ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1490] ret = ldv_msg_fill(m, i2c_msg[i].buf, i2c_msg[i].len) [L1491] COND FALSE !(\read(ret)) [L1492] CALL, EXPR ldv_submit_msg(m) [L1169] COND TRUE __VERIFIER_nondet_int() [L1170] CALL ldv_list_add(&msg->list, &ldv_global_msg_list) [L1121] EXPR, FCALL head->next [L1121] CALL __ldv_list_add(new, head, head->next) [L1107] FCALL next->prev = new [L1108] FCALL new->next = next [L1109] FCALL new->prev = prev [L1110] RET, FCALL prev->next = new [L1121] RET __ldv_list_add(new, head, head->next) [L1170] ldv_list_add(&msg->list, &ldv_global_msg_list) [L1171] RET return 0; [L1492] EXPR ldv_submit_msg(m) [L1492] ret = ldv_submit_msg(m) [L1493] COND FALSE !(\read(ret)) [L1494] i++ [L1487] COND FALSE !(i < num) [L1496] RET return i; [L1508] EXPR adap->master_xfer(adap, msgs, num) [L1508] RET return adap->master_xfer(adap, msgs, num); [L1528] EXPR ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1528] ret = ldv_i2c_transfer(priv->client->adapter, msg, 2) [L1529] COND TRUE ret == 2 [L1530] FCALL memcpy(val, buf, 1) [L1531] ret = 0 [L1535] return ret; [L1535] return ret; [L1535] return ret; [L1515-L1527] FCALL struct ldv_i2c_msg msg[2] = { { .addr = priv->client->addr, .flags = 0, .len = 1, .buf = ®, }, { .addr = priv->client->addr, .flags = 1, .len = 1, .buf = buf, } }; [L1535] RET return ret; [L1548] EXPR ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1548] ret = ldv_m88ts2022_rd_reg(priv, 0x00, &chip_id) [L1549] COND FALSE !(\read(ret)) [L1551] FCALL \read(chip_id) [L1552] case 0xc3: [L1553] case 0x83: [L1560] FCALL fe->tuner_priv = priv [L1561] CALL ldv_i2c_set_clientdata(client, priv) [L1462] CALL ldv_dev_set_drvdata(&dev->dev, data) [L1198] FCALL dev->driver_data = data [L1462] FCALL ldv_dev_set_drvdata(&dev->dev, data) [L1562] return 0; [L1562] RET return 0; [L1602] EXPR alloc_fix_12(client) [L1602] COND TRUE alloc_fix_12(client)==0 [L1603] CALL free_12(client) [L1570] EXPR, FCALL client->dev.platform_data [L1570] struct ldv_m88ts2022_config *cfg = (struct ldv_m88ts2022_config *)client->dev.platform_data; [L1571] EXPR, FCALL cfg->fe [L1571] struct ldv_dvb_frontend *fe = cfg->fe; [L1572] FCALL fe->tuner_priv = 0 [L1573] CALL, EXPR ldv_i2c_get_clientdata(client) [L1457] CALL, EXPR ldv_dev_get_drvdata(&dev->dev) [L1193] EXPR, FCALL dev->driver_data [L1193] RET return dev->driver_data; [L1457] EXPR ldv_dev_get_drvdata(&dev->dev) [L1457] RET return ldv_dev_get_drvdata(&dev->dev); [L1573] EXPR ldv_i2c_get_clientdata(client) [L1573] void *priv = (struct ldv_m88ts2022_priv *)ldv_i2c_get_clientdata(client); [L1574] COND TRUE \read(*priv) [L1575] FCALL free(priv) - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: -1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: -1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: free always succeeds For all program executions holds that free always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location - PositiveResult [Line: 1]: pointer dereference always succeeds For all program executions holds that pointer dereference always succeeds at this location * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor: - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification ensures #valid == old(#valid); is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) - GenericResult: Unfinished Backtranslation Generated EnsuresSpecification free ensures #res.base == dest.base && #res.offset == dest.offset; is not ensure(true) RESULT: Ultimate could not prove your program: unable to determine feasibility of some traces Written .csv to /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../releaseScripts/default/UAutomizer-linux/csv/memleaks_test12_true-valid-memsafety.i_svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf_AbstractInterpretationC.xml/Csv-Benchmark-0-2018-01-24_16-31-09-915.csv Written .csv to /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../releaseScripts/default/UAutomizer-linux/csv/memleaks_test12_true-valid-memsafety.i_svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf_AbstractInterpretationC.xml/Csv-VPDomainBenchmark-0-2018-01-24_16-31-09-915.csv Written .csv to /storage/ultimate/releaseScripts/default/UAutomizer-linux/../../../releaseScripts/default/UAutomizer-linux/csv/memleaks_test12_true-valid-memsafety.i_svcomp-DerefFreeMemtrack-32bit-Automizer_Camel+AI_EQ_imprecise.epf_AbstractInterpretationC.xml/Csv-BenchmarkWithCounters-0-2018-01-24_16-31-09-915.csv Received shutdown request...