make tidy does not work

[rdevshp]

$ clang-tidy --version
Debian LLVM version 19.1.7
  Optimized build.

I am using clang/clang-tidy 19.1.7, and make tidy errors out.

[thestinger]

I fixed most of the warnings but don't feel like trying to understand this mess:

/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:432:22: error: Out of bound access to memory after the end of the field 'bitmap' [clang-analyzer-security.ArrayBound,-warnings-as-errors]
  432 |             masked = metadata->bitmap[i];
      |                      ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:1716:12: note: Calling 'alloc_aligned_simple'
 1716 |     return alloc_aligned_simple(PAGE_SIZE, size);
      |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:1510:15: note: Calling 'alloc_aligned'
 1510 |     int ret = alloc_aligned(&ptr, alignment, size, 1);
      |               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:1503:15: note: Calling 'allocate_aligned'
 1503 |     int ret = allocate_aligned(arena, memptr, alignment, size, min_alignment);
      |               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:1446:9: note: Left side of '||' is false
 1446 |     if ((alignment - 1) & alignment || alignment < min_alignment) {
      |         ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:1446:40: note: 'alignment' is >= 'min_alignment'
 1446 |     if ((alignment - 1) & alignment || alignment < min_alignment) {
      |                                        ^~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:1446:5: note: Taking false branch
 1446 |     if ((alignment - 1) & alignment || alignment < min_alignment) {
      |     ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:1450:5: note: Taking true branch
 1450 |     if (alignment <= PAGE_SIZE) {
      |     ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:1451:13: note: 'size' is <= 'max_slab_size_class'
 1451 |         if (size <= max_slab_size_class && alignment > min_align) {
      |             ^~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:1451:13: note: Left side of '&&' is true
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:1451:44: note: 'alignment' is > 'min_align'
 1451 |         if (size <= max_slab_size_class && alignment > min_align) {
      |                                            ^~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:1451:9: note: Taking true branch
 1451 |         if (size <= max_slab_size_class && alignment > min_align) {
      |         ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:1455:19: note: Calling 'allocate'
 1455 |         void *p = allocate(arena, size);
      |                   ^~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:1419:12: note: Assuming 'size' is <= 'max_slab_size_class'
 1419 |     return size <= max_slab_size_class ? allocate_small(arena, size) : allocate_large(size);
      |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:1419:12: note: '?' condition is true
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:1419:42: note: Calling 'allocate_small'
 1419 |     return size <= max_slab_size_class ? allocate_small(arena, size) : allocate_large(size);
      |                                          ^~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:629:19: note: Assuming field 'size' is not equal to 0
  629 |     size_t size = likely(info.size) ? info.size : 16;
      |                   ^
/home/strcat/projects/grapheneos/hardened_malloc/util.h:11:37: note: expanded from macro 'likely'
   11 | #define likely(x) __builtin_expect(!!(x), 1)
      |                                     ^~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:629:19: note: '?' condition is true
  629 |     size_t size = likely(info.size) ? info.size : 16;
      |                   ^
/home/strcat/projects/grapheneos/hardened_malloc/util.h:11:19: note: expanded from macro 'likely'
   11 | #define likely(x) __builtin_expect(!!(x), 1)
      |                   ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:637:9: note: Assuming field 'partial_slabs' is equal to NULL
  637 |     if (c->partial_slabs == NULL) {
      |         ^~~~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:637:5: note: Taking true branch
  637 |     if (c->partial_slabs == NULL) {
      |     ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:638:13: note: Assuming field 'empty_slabs' is equal to NULL
  638 |         if (c->empty_slabs != NULL) {
      |             ^~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:638:9: note: Taking false branch
  638 |         if (c->empty_slabs != NULL) {
      |         ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:667:13: note: Assuming field 'free_slabs_head' is not equal to NULL
  667 |         if (c->free_slabs_head != NULL) {
      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:667:9: note: Taking true branch
  667 |         if (c->free_slabs_head != NULL) {
      |         ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:672:17: note: 'requested_size' is not equal to 0
  672 |             if (requested_size && memory_protect_rw(slab, slab_size)) {
      |                 ^~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:672:17: note: Left side of '&&' is true
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:672:35: note: Assuming the condition is false
  672 |             if (requested_size && memory_protect_rw(slab, slab_size)) {
      |                                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:672:13: note: Taking false branch
  672 |             if (requested_size && memory_protect_rw(slab, slab_size)) {
      |             ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:678:17: note: Assuming field 'free_slabs_head' is not equal to NULL
  678 |             if (c->free_slabs_head == NULL) {
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:678:13: note: Taking false branch
  678 |             if (c->free_slabs_head == NULL) {
      |             ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:685:32: note: Assuming 'slots' is <= 1
  685 |             c->partial_slabs = slots > 1 ? metadata : NULL;
      |                                ^~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:685:32: note: '?' condition is false
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:687:27: note: Calling 'get_free_slot'
  687 |             size_t slot = get_free_slot(&c->rng, slots, metadata);
      |                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:413:5: note: Taking true branch
  413 |     if (SLOT_RANDOMIZE) {
      |     ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:417:30: note: Assuming right operand of bit shift is less than 64
  417 |         u64 random_split = ~(~0UL << (random_index - first_bitmap * U64_WIDTH));
      |                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:422:9: note: Loop condition is true.  Entering loop body
  422 |         for (;;) {
      |         ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:423:17: note: Assuming the condition is false
  423 |             if (i == slots / U64_WIDTH) {
      |                 ^~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:423:13: note: Taking false branch
  423 |             if (i == slots / U64_WIDTH) {
      |             ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:427:17: note: Assuming the condition is false
  427 |             if (masked != ~0UL) {
      |                 ^~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:427:13: note: Taking false branch
  427 |             if (masked != ~0UL) {
      |             ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:431:17: note: Assuming the condition is false
  431 |             i = i == (slots - 1) / U64_WIDTH ? 0 : i + 1;
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:431:17: note: '?' condition is false
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:422:9: note: Loop condition is true.  Entering loop body
  422 |         for (;;) {
      |         ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:423:17: note: Assuming the condition is false
  423 |             if (i == slots / U64_WIDTH) {
      |                 ^~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:423:13: note: Taking false branch
  423 |             if (i == slots / U64_WIDTH) {
      |             ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:427:17: note: Assuming the condition is false
  427 |             if (masked != ~0UL) {
      |                 ^~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:427:13: note: Taking false branch
  427 |             if (masked != ~0UL) {
      |             ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:431:17: note: Assuming the condition is false
  431 |             i = i == (slots - 1) / U64_WIDTH ? 0 : i + 1;
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:431:17: note: '?' condition is false
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:422:9: note: Loop condition is true.  Entering loop body
  422 |         for (;;) {
      |         ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:423:17: note: Assuming the condition is false
  423 |             if (i == slots / U64_WIDTH) {
      |                 ^~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:423:13: note: Taking false branch
  423 |             if (i == slots / U64_WIDTH) {
      |             ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:427:17: note: Assuming the condition is false
  427 |             if (masked != ~0UL) {
      |                 ^~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:427:13: note: Taking false branch
  427 |             if (masked != ~0UL) {
      |             ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:431:17: note: Assuming the condition is false
  431 |             i = i == (slots - 1) / U64_WIDTH ? 0 : i + 1;
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:431:17: note: '?' condition is false
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:422:9: note: Loop condition is true.  Entering loop body
  422 |         for (;;) {
      |         ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:423:17: note: Assuming the condition is false
  423 |             if (i == slots / U64_WIDTH) {
      |                 ^~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:423:13: note: Taking false branch
  423 |             if (i == slots / U64_WIDTH) {
      |             ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:427:17: note: Assuming the condition is false
  427 |             if (masked != ~0UL) {
      |                 ^~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:427:13: note: Taking false branch
  427 |             if (masked != ~0UL) {
      |             ^
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:431:17: note: Assuming the condition is false
  431 |             i = i == (slots - 1) / U64_WIDTH ? 0 : i + 1;
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:431:17: note: '?' condition is false
/home/strcat/projects/grapheneos/hardened_malloc/h_malloc.c:432:22: note: Access of the field 'bitmap' at index 4, while it holds only 4 'unsigned long' elements
  432 |             masked = metadata->bitmap[i];
      |                      ^~~~~~~~~~~~~~~~~~~

It's nearly certainly a false positive but it's possible we could change the code to make it more clearly correct where it wouldn't trigger.

[thestinger]

There's also this one I haven't dealt with yet:

/home/strcat/projects/grapheneos/hardened_malloc/util.h:51:28: error: narrowing conversion from 'u64' (aka 'unsigned long') to signed type 'long long' is implementation-defined [bugprone-narrowing-conversions,-warnings-as-errors]
   51 |     return __builtin_ffsll(~x);
      |                            ^

Feel free to figure out the best way to deal with that, which may just be an explicit cast.