github / github/codeql

false positive - cpp/unused-static-function

Open
#11,219 6 comments 0 reactions 0 assignees View on GitHub
acknowledged false-positive
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

**Description of the false positive**

Every instance of this on the OpenZFS codebase that I have checked appears to be a false positive.

For example, it reports `rrw_enter_read_impl()` is unused, when it is used in `rrw_enter_read()`, which is the next function definition:

https://github.com/ryao/zfs/security/code-scanning/184

The same happens with `abd_fletcher_4_impl()`:

https://github.com/ryao/zfs/security/code-scanning/203

And again with `zfs_rangelock_enter_writer()`, which is used in `zfs_rangelock_enter_impl()`:

https://github.com/ryao/zfs/security/code-scanning/202

Then there is `zfs_rangelock_enter_impl()`, which is used in `zfs_rangelock_enter()`:

https://github.com/ryao/zfs/security/code-scanning/200

zfs_ace_byteswap(), used in `zfs_acl_byteswap()`:

https://github.com/ryao/zfs/security/code-scanning/199

`chksum_run()`, used in `chksum_benchit()`:

https://github.com/ryao/zfs/security/code-scanning/198

`zap_cursor_init_impl()`, used in `zap_cursor_init_serialized()`, `zap_cursor_init()` and `zap_cursor_init_noprefetch()`:

https://github.com/ryao/zfs/security/code-scanning/197

`vdev_indirect_mapping_entry_for_offset_impl()`, used in multiple functions:

https://github.com/ryao/zfs/security/code-scanning/196

`vdev_open_children_impl()`, used in `vdev_open_children()`:

https://github.com/ryao/zfs/security/code-scanning/195

`space_reftree_add_node()`, used in `space_reftree_add_seg()`:

https://github.com/ryao/zfs/security/code-scanning/194

I suspect that all 43 reports are false positives, although so far, I have only explicitly checked about half of them. I have glanced at the ones that I did not explicitly check and I would be very surprised if any of those functions are unused since they are almost entirely important functions in the codebase.

Unused static functions tend to be pruned from the codebase fairly quickly, so I suspect that every report against the OpenZFS codebase is a false positive.

This is probably a duplicate of #10442. However, I figured I would file an issue anyway since the OpenZFS codebase should serve as a decent corpus on which to develop a revised query.

Contributor guide

Open the contributing guide

Research direction

The issue names the cpp/unused-static-function query and links ten OpenZFS code-scanning alerts, with 43 reports suspected to be false positives. Start by reproducing the linked alerts and checking how the query resolves the listed caller relationships. Done means the false-positive behavior is understood and the query has appropriate regression coverage for this corpus.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.