many: final set of coccinelle check-pointer-deref tweaks (#41426)

This is a followup to https://github.com/systemd/systemd/pull/41400 with
the final set of tweaks so that the new coccinelle `check-pinters-deref`
checker runs without failures.

It also includes a commit with some fixes for redundant asserts and the
final commit to make the assert() in the inner loop of qsort
POINTER_MAY_BE_NULL which will become a no-op - that is probably the
most controversial one, I hope the commit message explains the
trade-offs, I'm happy to drop it, I have no strong opinion either way.

Please see the individual commits/commit messages for more details, most
is (hopefully) relatively boring/mechanical.

meson.build

@@ -2974,12 +2974,7 @@ endif
 
 spatch = find_program('spatch', required : false)
 if spatch.found()
-        # Directories excluded from coccinelle checks until their warnings are fixed.
-        # Remove directories from this list as they are cleaned up.
         coccinelle_exclude = [
-                'src/basic/',
-                'src/libsystemd/',
-                'src/shared/',
                 # libc/ has no assert() or systemd-headers so leave it
                 'src/libc/',
                 # test/ has some deliberate wonky pointers, just leave excluded

src/analyze/analyze-security.c

@@ -577,8 +577,7 @@ static bool syscall_names_in_filter(Set *s, bool allow_list, const SyscallFilter
 
                 if (set_contains(s, syscall) == allow_list) {
                         log_debug("Offending syscall filter item: %s", syscall);
-                        if (ret_offending_syscall)
-                                *ret_offending_syscall = syscall;
+                        *ret_offending_syscall = syscall;
                         return true; /* bad! */
                 }
         }

src/basic/alloc-util.c

@@ -35,6 +35,8 @@ void* memdup_suffix0(const void *p, size_t l) {
 }
 
 size_t malloc_sizeof_safe(void **xp) {
+        POINTER_MAY_BE_NULL(xp);
+
         if (_unlikely_(!xp || !*xp))
                 return 0;
 

src/basic/devnum-util.c

@@ -18,6 +18,8 @@ int parse_devnum(const char *s, dev_t *ret) {
         size_t n;
         int r;
 
+        assert(ret);
+
         n = strspn(s, DIGITS);
         if (n == 0)
                 return -EINVAL;

src/basic/escape.c

@@ -106,6 +106,7 @@ int cunescape_one(const char *p, size_t length, char32_t *ret, bool *eight_bit,
 
         assert(p);
         assert(ret);
+        assert(eight_bit);
 
         /* Unescapes C style. Returns the unescaped character in ret.
          * Sets *eight_bit to true if the escaped sequence either fits in

src/basic/ether-addr-util.c

@@ -115,10 +115,15 @@ char* ether_addr_to_string(const struct ether_addr *addr, char buffer[ETHER_ADDR
 }
 
 int ether_addr_compare(const struct ether_addr *a, const struct ether_addr *b) {
+        assert(a);
+        assert(b);
+
         return memcmp(a, b, ETH_ALEN);
 }
 
 static void ether_addr_hash_func(const struct ether_addr *p, struct siphash *state) {
+        assert(p);
+
         siphash24_compress_typesafe(*p, state);
 }
 

src/basic/extract-word.c

@@ -204,6 +204,9 @@ int extract_first_word_and_warn(
         const char *save;
         int r;
 
+        assert(p);
+        assert(ret);
+
         save = *p;
         r = extract_first_word(p, ret, separators, flags);
         if (r >= 0)

src/basic/fd-util.c

@@ -875,6 +875,7 @@ int fd_reopen_condition(
 
         assert(fd >= 0);
         assert(!FLAGS_SET(flags, O_CREAT));
+        assert(ret_new_fd);
 
         /* Invokes fd_reopen(fd, flags), but only if the existing F_GETFL flags don't match the specified
          * flags (masked by the specified mask). This is useful for converting O_PATH fds into real fds if

src/basic/glob-util.c

@@ -11,6 +11,9 @@
 
 #ifndef __GLIBC__
 static bool safe_glob_verify(const char *p, const char *prefix) {
+        POINTER_MAY_BE_NULL(p);
+        POINTER_MAY_BE_NULL(prefix);
+
         if (isempty(p))
                 return false; /* should not happen, but for safey. */
 
@@ -162,6 +165,9 @@ int glob_extend(char ***strv, const char *path, int flags) {
 }
 
 int glob_non_glob_prefix(const char *path, char **ret) {
+        assert(path);
+        assert(ret);
+
         /* Return the path of the path that has no glob characters. */
 
         size_t n = strcspn(path, GLOB_CHARS);

src/basic/gunicode.c

@@ -27,6 +27,8 @@
 char *
 utf8_prev_char (const char *p)
 {
+  assert(p);
+
   for (;;)
     {
       p--;

src/basic/hash-funcs.c

@@ -103,10 +103,15 @@ DEFINE_HASH_OPS_FULL(
                 void, free);
 
 void uint64_hash_func(const uint64_t *p, struct siphash *state) {
+        assert(p);
+
         siphash24_compress_typesafe(*p, state);
 }
 
 int uint64_compare_func(const uint64_t *a, const uint64_t *b) {
+        assert(a);
+        assert(b);
+
         return CMP(*a, *b);
 }
 
@@ -119,6 +124,8 @@ DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR(
 
 #if SIZEOF_DEV_T != 8
 void devt_hash_func(const dev_t *p, struct siphash *state) {
+        assert(p);
+
         siphash24_compress_typesafe(*p, state);
 }
 #endif
@@ -126,6 +133,9 @@ void devt_hash_func(const dev_t *p, struct siphash *state) {
 int devt_compare_func(const dev_t *a, const dev_t *b) {
         int r;
 
+        assert(a);
+        assert(b);
+
         r = CMP(major(*a), major(*b));
         if (r != 0)
                 return r;

src/basic/hashmap.c

@@ -848,6 +848,8 @@ int set_ensure_allocated(Set **s, const struct hash_ops *hash_ops) {
 int hashmap_ensure_put(Hashmap **h, const struct hash_ops *hash_ops, const void *key, void *value) {
         int r;
 
+        assert(h);
+
         r = hashmap_ensure_allocated(h, hash_ops);
         if (r < 0)
                 return r;
@@ -858,6 +860,8 @@ int hashmap_ensure_put(Hashmap **h, const struct hash_ops *hash_ops, const void
 int ordered_hashmap_ensure_put(OrderedHashmap **h, const struct hash_ops *hash_ops, const void *key, void *value) {
         int r;
 
+        assert(h);
+
         r = ordered_hashmap_ensure_allocated(h, hash_ops);
         if (r < 0)
                 return r;
@@ -868,6 +872,8 @@ int ordered_hashmap_ensure_put(OrderedHashmap **h, const struct hash_ops *hash_o
 int ordered_hashmap_ensure_replace(OrderedHashmap **h, const struct hash_ops *hash_ops, const void *key, void *value) {
         int r;
 
+        assert(h);
+
         r = ordered_hashmap_ensure_allocated(h, hash_ops);
         if (r < 0)
                 return r;
@@ -878,6 +884,8 @@ int ordered_hashmap_ensure_replace(OrderedHashmap **h, const struct hash_ops *ha
 int hashmap_ensure_replace(Hashmap **h, const struct hash_ops *hash_ops, const void *key, void *value) {
         int r;
 
+        assert(h);
+
         r = hashmap_ensure_allocated(h, hash_ops);
         if (r < 0)
                 return r;
@@ -1283,6 +1291,8 @@ int set_put(Set *s, const void *key) {
 int set_ensure_put(Set **s, const struct hash_ops *hash_ops, const void *key) {
         int r;
 
+        assert(s);
+
         r = set_ensure_allocated(s, hash_ops);
         if (r < 0)
                 return r;

src/basic/in-addr-util.c

@@ -841,6 +841,8 @@ int in_addr_parse_prefixlen(int family, const char *p, unsigned char *ret) {
         uint8_t u;
         int r;
 
+        assert(ret);
+
         if (!IN_SET(family, AF_INET, AF_INET6))
                 return -EAFNOSUPPORT;
 

src/basic/io-util.c

@@ -248,6 +248,8 @@ int fd_wait_for_event(int fd, int event, usec_t timeout) {
 static size_t nul_length(const uint8_t *p, size_t sz) {
         size_t n = 0;
 
+        assert(p);
+
         while (sz > 0) {
                 if (*p != 0)
                         break;

src/basic/log.c

@@ -950,6 +950,9 @@ int log_format_iovec(
                 const char *format,
                 va_list ap) {
 
+        assert(iovec);
+        assert(n);
+
         while (format && *n + 1 < iovec_len) {
                 va_list aq;
                 char *m;

src/basic/mountpoint-util.c

@@ -320,6 +320,8 @@ int path_get_mnt_id_at(int dir_fd, const char *path, int *ret) {
         uint64_t mnt_id;
         int r;
 
+        assert(ret);
+
         r = path_get_mnt_id_at_internal(dir_fd, path, /* unique = */ false, &mnt_id);
         if (r < 0)
                 return r;
@@ -597,6 +599,9 @@ const char* mount_propagation_flag_to_string(unsigned long flags) {
 
 int mount_propagation_flag_from_string(const char *name, unsigned long *ret) {
 
+        POINTER_MAY_BE_NULL(name);
+        assert(ret);
+
         if (isempty(name))
                 *ret = 0;
         else if (streq(name, "shared"))

src/basic/ordered-set.c

@@ -9,6 +9,8 @@
 #include "strv.h"
 
 int ordered_set_ensure_allocated(OrderedSet **s, const struct hash_ops *ops) {
+        assert(s);
+
         if (*s)
                 return 0;
 
@@ -22,6 +24,8 @@ int ordered_set_ensure_allocated(OrderedSet **s, const struct hash_ops *ops) {
 int ordered_set_ensure_put(OrderedSet **s, const struct hash_ops *ops, void *p) {
         int r;
 
+        assert(s);
+
         r = ordered_set_ensure_allocated(s, ops);
         if (r < 0)
                 return r;

src/basic/parse-util.c

@@ -127,6 +127,8 @@ int parse_mtu(int family, const char *s, uint32_t *ret) {
         uint64_t u, m;
         int r;
 
+        assert(ret);
+
         r = parse_size(s, 1024, &u);
         if (r < 0)
                 return r;
@@ -376,6 +378,9 @@ int parse_user_shell(const char *s, char **ret_sh, bool *ret_copy) {
         char *sh;
         int r;
 
+        assert(ret_sh);
+        assert(ret_copy);
+
         if (path_is_absolute(s) && path_is_normalized(s)) {
                 sh = strdup(s);
                 if (!sh)
@@ -476,6 +481,8 @@ int safe_atou_bounded(const char *s, unsigned min, unsigned max, unsigned *ret)
         unsigned v;
         int r;
 
+        assert(ret);
+
         r = safe_atou(s, &v);
         if (r < 0)
                 return r;
@@ -577,6 +584,8 @@ int safe_atou8_full(const char *s, unsigned base, uint8_t *ret) {
         unsigned u;
         int r;
 
+        assert(ret);
+
         r = safe_atou_full(s, base, &u);
         if (r < 0)
                 return r;
@@ -591,6 +600,8 @@ int safe_atou16_full(const char *s, unsigned base, uint16_t *ret) {
         unsigned u;
         int r;
 
+        assert(ret);
+
         r = safe_atou_full(s, base, &u);
         if (r < 0)
                 return r;
@@ -654,6 +665,9 @@ int parse_fractional_part_u(const char **p, size_t digits, unsigned *res) {
         unsigned val = 0;
         const char *s;
 
+        assert(p);
+        assert(res);
+
         s = *p;
 
         /* accept any number of digits, strtoull is limited to 19 */
@@ -688,6 +702,8 @@ int parse_fractional_part_u(const char **p, size_t digits, unsigned *res) {
 int parse_nice(const char *s, int *ret) {
         int n, r;
 
+        assert(ret);
+
         r = safe_atoi(s, &n);
         if (r < 0)
                 return r;
@@ -703,6 +719,8 @@ int parse_ip_port(const char *s, uint16_t *ret) {
         uint16_t l;
         int r;
 
+        assert(ret);
+
         r = safe_atou16_full(s, SAFE_ATO_REFUSE_LEADING_WHITESPACE, &l);
         if (r < 0)
                 return r;
@@ -719,6 +737,9 @@ int parse_ip_port_range(const char *s, uint16_t *low, uint16_t *high, bool allow
         unsigned l, h;
         int r;
 
+        assert(low);
+        assert(high);
+
         r = parse_range(s, &l, &h);
         if (r < 0)
                 return r;

src/basic/path-util.c

@@ -587,6 +587,8 @@ char* path_extend_internal(char **x, ...) {
         va_list ap;
         bool slash;
 
+        POINTER_MAY_BE_NULL(x);
+
         /* Joins all listed strings until the sentinel and places a "/" between them unless the strings
          * end/begin already with one so that it is unnecessary. Note that slashes which are already
          * duplicate won't be removed. The string returned is hence always equal to or longer than the sum of
@@ -830,6 +832,8 @@ int fsck_exists_for_fstype(const char *fstype) {
 }
 
 static const char* skip_slash_or_dot(const char *p) {
+        POINTER_MAY_BE_NULL(p);
+
         for (; !isempty(p); p++) {
                 if (*p == '/')
                         continue;
@@ -933,6 +937,9 @@ int path_find_last_component(const char *path, bool accept_dot_dot, const char *
         const char *q, *last_end, *last_begin;
         size_t len;
 
+        POINTER_MAY_BE_NULL(next);
+        POINTER_MAY_BE_NULL(ret);
+
         /* Similar to path_find_first_component(), but search components from the end.
         *
         * Examples

src/basic/prioq.c

@@ -168,6 +168,8 @@ int prioq_put(Prioq *q, void *data, unsigned *idx) {
 int _prioq_ensure_put(Prioq **q, compare_func_t compare_func, void *data, unsigned *idx) {
         int r;
 
+        assert(q);
+
         r = prioq_ensure_allocated(q, compare_func);
         if (r < 0)
                 return r;

src/basic/process-util.c

@@ -1151,6 +1151,8 @@ int safe_personality(unsigned long p) {
 int opinionated_personality(unsigned long *ret) {
         int current;
 
+        assert(ret);
+
         /* Returns the current personality, or PERSONALITY_INVALID if we can't determine it. This function is a bit
          * opinionated though, and ignores all the finer-grained bits and exotic personalities, only distinguishing the
          * two most relevant personalities: PER_LINUX and PER_LINUX32. */
@@ -1191,6 +1193,9 @@ void valgrind_summary_hack(void) {
 
 int pid_compare_func(const pid_t *a, const pid_t *b) {
         /* Suitable for usage in qsort() */
+        assert(a);
+        assert(b);
+
         return CMP(*a, *b);
 }
 

src/basic/recurse-dir.c

@@ -16,6 +16,9 @@
 #define DEFAULT_RECURSION_MAX 100
 
 static int sort_func(struct dirent * const *a, struct dirent * const *b) {
+        assert(a);
+        assert(b);
+
         return strcmp((*a)->d_name, (*b)->d_name);
 }
 

src/basic/rlimit-util.c

@@ -170,6 +170,9 @@ static int rlimit_parse_nice(const char *val, rlim_t *ret) {
         uint64_t rl;
         int r;
 
+        assert(val);
+        assert(ret);
+
         /* So, Linux is weird. The range for RLIMIT_NICE is 40..1, mapping to the nice levels -20..19. However, the
          * RLIMIT_NICE limit defaults to 0 by the kernel, i.e. a value that maps to nice level 20, which of course is
          * bogus and does not exist. In order to permit parsing the RLIMIT_NICE of 0 here we hence implement a slight

src/basic/socket-util.c

@@ -360,6 +360,7 @@ int sockaddr_port(const struct sockaddr *_sa, unsigned *ret_port) {
         /* Note, this returns the port as 'unsigned' rather than 'uint16_t', as AF_VSOCK knows larger ports */
 
         assert(sa);
+        assert(ret_port);
 
         switch (sa->sa.sa_family) {
 
@@ -824,6 +825,8 @@ bool ifname_valid_full(const char *p, IfnameValidFlags flags) {
 
 bool address_label_valid(const char *p) {
 
+        POINTER_MAY_BE_NULL(p);
+
         if (isempty(p))
                 return false;
 
@@ -1556,6 +1559,8 @@ int socket_set_option(int fd, int af, int opt_ipv4, int opt_ipv6, int val) {
 int socket_get_mtu(int fd, int af, size_t *ret) {
         int mtu, r;
 
+        assert(ret);
+
         if (af == AF_UNSPEC) {
                 af = socket_get_family(fd);
                 if (af < 0)

src/basic/sort-util.c

@@ -65,9 +65,19 @@ void qsort_r_safe(void *base, size_t nmemb, size_t size, comparison_userdata_fn_
 }
 
 int cmp_int(const int *a, const int *b) {
+        /* This is called from qsort()s inner loops. Correctly implemented qsort will never pass NULL so we
+           just suppress the check via POINTER_MAY_BE_NULL instead of assert() to avoid the runtime cost. */
+        POINTER_MAY_BE_NULL(a);
+        POINTER_MAY_BE_NULL(b);
+
         return CMP(*a, *b);
 }
 
 int cmp_uint16(const uint16_t *a, const uint16_t *b) {
+        /* This is called from qsort()s inner loops. Correctly implemented qsort will never pass NULL so we
+           just suppress the check via POINTER_MAY_BE_NULL instead of assert() to avoid the runtime cost. */
+        POINTER_MAY_BE_NULL(a);
+        POINTER_MAY_BE_NULL(b);
+
         return CMP(*a, *b);
 }

src/basic/string-table.c

@@ -41,6 +41,8 @@ ssize_t string_table_lookup_from_string_with_boolean(const char * const *table,
 int string_table_lookup_to_string_fallback(const char * const *table, size_t len, ssize_t i, size_t max, char **ret) {
         char *s;
 
+        assert(ret);
+
         if (i < 0 || i > (ssize_t) max)
                 return -ERANGE;
 

src/basic/string-util.c

@@ -174,6 +174,9 @@ char* ascii_strlower_n(char *s, size_t n) {
 
 int ascii_strcasecmp_n(const char *a, const char *b, size_t n) {
 
+        assert(a);
+        assert(b);
+
         for (; n > 0; a++, b++, n--) {
                 int x, y;
 
@@ -276,6 +279,10 @@ static bool string_has_ansi_sequence(const char *s, size_t len) {
 }
 
 static size_t previous_ansi_sequence(const char *s, size_t length, const char **ret_where) {
+
+        assert(s);
+        assert(ret_where);
+
         /* Locate the previous ANSI sequence and save its start in *ret_where and return length. */
 
         for (size_t i = length - 2; i > 0; i--) {  /* -2 because at least two bytes are needed */
@@ -1133,6 +1140,7 @@ int string_truncate_lines(const char *s, size_t n_lines, char **ret) {
         size_t n = 0;
 
         assert(s);
+        assert(ret);
 
         /* Truncate after the specified number of lines. Returns > 0 if a truncation was applied or == 0 if
          * there were fewer lines in the string anyway. Trailing newlines on input are ignored, and not
@@ -1187,6 +1195,8 @@ int string_extract_line(const char *s, size_t i, char **ret) {
         const char *p = s;
         size_t c = 0;
 
+        assert(ret);
+
         /* Extract the i'nth line from the specified string. Returns > 0 if there are more lines after that,
          * and == 0 if we are looking at the last line or already beyond the last line. As special
          * optimization, if the first line is requested and the string only consists of one line we return

src/basic/strv.c

@@ -587,6 +587,9 @@ int strv_push_with_size(char ***l, size_t *n, char *value) {
          * If n is not NULL, the size after the push will be returned.
          * If value is empty, no action is taken and *n is not set. */
 
+        assert(l);
+        POINTER_MAY_BE_NULL(n);
+
         if (!value)
                 return 0;
 
@@ -615,6 +618,8 @@ int strv_push_pair(char ***l, char *a, char *b) {
         char **c;
         size_t n;
 
+        assert(l);
+
         if (!a && !b)
                 return 0;
 
@@ -828,6 +833,9 @@ char** strv_remove(char **l, const char *s) {
 }
 
 bool strv_overlap(char * const *a, char * const *b) {
+        POINTER_MAY_BE_NULL(a);
+        POINTER_MAY_BE_NULL(b);
+
         STRV_FOREACH(i, a)
                 if (strv_contains(b, *i))
                         return true;
@@ -836,6 +844,11 @@ bool strv_overlap(char * const *a, char * const *b) {
 }
 
 static int str_compare(char * const *a, char * const *b) {
+        /* This is called from qsort()s inner loops. Correctly implemented qsort will never pass NULL so we
+           just suppress the check via POINTER_MAY_BE_NULL instead of assert() to avoid the runtime cost. */
+        POINTER_MAY_BE_NULL(a);
+        POINTER_MAY_BE_NULL(b);
+
         return strcmp(*a, *b);
 }
 
@@ -862,6 +875,9 @@ char** strv_sort_uniq(char **l) {
 int strv_compare(char * const *a, char * const *b) {
         int r;
 
+        POINTER_MAY_BE_NULL(a);
+        POINTER_MAY_BE_NULL(b);
+
         if (strv_isempty(a)) {
                 if (strv_isempty(b))
                         return 0;

src/basic/uid-classification.c

@@ -25,6 +25,8 @@ static int parse_alloc_uid(const char *path, const char *name, const char *t, ui
         uid_t uid;
         int r;
 
+        assert(ret_uid);
+
         r = parse_uid(t, &uid);
         if (r < 0)
                 return log_debug_errno(r, "%s: failed to parse %s %s, ignoring: %m", path, name, t);

src/basic/unit-def.c

@@ -24,6 +24,8 @@ int unit_name_from_dbus_path(const char *path, char **name) {
         const char *e;
         char *n;
 
+        assert(name);
+
         e = startswith(path, "/org/freedesktop/systemd1/unit/");
         if (!e)
                 return -EINVAL;

src/basic/utf8.c

@@ -63,6 +63,7 @@ int utf8_encoded_to_unichar(const char *str, char32_t *ret_unichar) {
         size_t len;
 
         assert(str);
+        assert(ret_unichar);
 
         len = utf8_encoded_expected_len(str[0]);
 
@@ -500,6 +501,8 @@ size_t char16_strlen(const char16_t *s) {
 }
 
 size_t char16_strsize(const char16_t *s) {
+        POINTER_MAY_BE_NULL(s);
+
         return s ? (char16_strlen(s) + 1) * sizeof(*s) : 0;
 }
 
@@ -566,6 +569,8 @@ int utf8_encoded_valid_unichar(const char *str, size_t length /* bytes */) {
 size_t utf8_n_codepoints(const char *str) {
         size_t n = 0;
 
+        assert(str);
+
         /* Returns the number of UTF-8 codepoints in this string, or SIZE_MAX if the string is not valid UTF-8. */
 
         while (*str != 0) {
@@ -583,6 +588,7 @@ size_t utf8_n_codepoints(const char *str) {
 }
 
 size_t utf8_console_width(const char *str) {
+        POINTER_MAY_BE_NULL(str);
 
         if (isempty(str))
                 return 0;

src/core/job.c

@@ -1525,10 +1525,10 @@ void job_add_to_gc_queue(Job *j) {
 }
 
 static int job_compare_id(Job * const *a, Job * const *b) {
-        assert(a);
-        assert(b);
-        assert(*a);
-        assert(*b);
+        /* This is called from qsort()s inner loops. Correctly implemented qsort will never pass NULL so we
+           just suppress the check via POINTER_MAY_BE_NULL instead of assert() to avoid the runtime cost. */
+        POINTER_MAY_BE_NULL(a);
+        POINTER_MAY_BE_NULL(b);
 
         return CMP((*a)->id, (*b)->id);
 }

src/libsystemd/sd-bus/bus-creds.c

@@ -358,6 +358,7 @@ _public_ int sd_bus_creds_get_tid(sd_bus_creds *c, pid_t *ret) {
 
 _public_ int sd_bus_creds_get_selinux_context(sd_bus_creds *c, const char **ret) {
         assert_return(c, -EINVAL);
+        assert_return(ret, -EINVAL);
 
         if (!(c->mask & SD_BUS_CREDS_SELINUX_CONTEXT))
                 return -ENODATA;

src/libsystemd/sd-bus/bus-error.c

@@ -165,6 +165,8 @@ static int errno_to_bus_error_name_new(int error, char **ret) {
         const char *name;
         char *n;
 
+        assert(ret);
+
         /* D-Bus names must not start with a digit. Thus, an name like System.Error.500 would not be legal.
          * Let's just return 0 if an unknown errno is encountered, which will cause the caller to fall back
          * to BUS_ERROR_FAILED.

src/libsystemd/sd-bus/bus-internal.c

@@ -263,6 +263,8 @@ bool path_simple_pattern(const char *pattern, const char *value) {
 }
 
 int bus_message_type_from_string(const char *s, uint8_t *u) {
+        assert(u);
+
         if (streq(s, "signal"))
                 *u = SD_BUS_MESSAGE_SIGNAL;
         else if (streq(s, "method_call"))

src/libsystemd/sd-bus/bus-introspect.c

@@ -175,6 +175,8 @@ static int introspect_write_arguments(BusIntrospect *i, const char *signature, c
 
         assert(i);
         assert(i->m.f);
+        assert(signature);
+        assert(names);
 
         for (;;) {
                 size_t l;

src/libsystemd/sd-bus/bus-objects.c

@@ -1704,6 +1704,10 @@ typedef enum {
 static bool names_are_valid(const char *signature, const char **names, names_flags *flags) {
         int r;
 
+        assert(signature);
+        assert(names);
+        assert(flags);
+
         if ((*flags & NAMES_FIRST_PART || *flags & NAMES_SINGLE_PART) && **names != '\0')
                 *flags |= NAMES_PRESENT;
 

src/libsystemd/sd-bus/bus-socket.c

@@ -35,6 +35,7 @@
 #define SNDBUF_SIZE (8*1024*1024)
 
 static void iovec_advance(struct iovec iov[], unsigned *idx, size_t size) {
+        assert(idx);
 
         while (size > 0) {
                 struct iovec *i = iov + *idx;

src/libsystemd/sd-bus/sd-bus.c

@@ -2021,6 +2021,7 @@ static int bus_write_message(sd_bus *bus, sd_bus_message *m, size_t *idx) {
 
         assert(bus);
         assert(m);
+        assert(idx);
 
         r = bus_socket_write_message(bus, m, idx);
         if (r <= 0)

src/libsystemd/sd-bus/test-bus-objects.c

@@ -177,6 +177,7 @@ static const sd_bus_vtable vtable2[] = {
 };
 
 static int enumerator_callback(sd_bus *bus, const char *path, void *userdata, char ***nodes, sd_bus_error *reterr_error) {
+        assert(nodes);
 
         if (object_path_startswith("/value", path))
                 ASSERT_NOT_NULL(*nodes = strv_new("/value/c", "/value/b", "/value/a"));
@@ -185,6 +186,7 @@ static int enumerator_callback(sd_bus *bus, const char *path, void *userdata, ch
 }
 
 static int enumerator2_callback(sd_bus *bus, const char *path, void *userdata, char ***nodes, sd_bus_error *reterr_error) {
+        assert(nodes);
 
         if (object_path_startswith("/value/a", path))
                 ASSERT_NOT_NULL(*nodes = strv_new("/value/a/z", "/value/a/x", "/value/a/y"));
@@ -195,6 +197,8 @@ static int enumerator2_callback(sd_bus *bus, const char *path, void *userdata, c
 static int enumerator3_callback(sd_bus *bus, const char *path, void *userdata, char ***nodes, sd_bus_error *reterr_error) {
         _cleanup_strv_free_ char **v = NULL;
 
+        assert(nodes);
+
         if (!object_path_startswith("/value/b", path))
                 return 1;
 

src/libsystemd/sd-bus/test-bus-vtable.c

@@ -22,6 +22,7 @@ static struct context c = {};
 static int happy_finder_object = 0;
 
 static int happy_finder(sd_bus *bus, const char *path, const char *interface, void *userdata, void **found, sd_bus_error *reterr_error) {
+        assert(found);
         assert(userdata);
         assert(userdata == &c);
 

src/libsystemd/sd-device/device-monitor.c

@@ -783,6 +783,8 @@ int device_monitor_send(
 
 static void bpf_stmt(struct sock_filter *ins, unsigned *i,
                      unsigned short code, unsigned data) {
+        assert(i);
+
         ins[(*i)++] = (struct sock_filter) {
                 .code = code,
                 .k = data,
@@ -792,6 +794,8 @@ static void bpf_stmt(struct sock_filter *ins, unsigned *i,
 static void bpf_jmp(struct sock_filter *ins, unsigned *i,
                     unsigned short code, unsigned data,
                     unsigned short jt, unsigned short jf) {
+        assert(i);
+
         ins[(*i)++] = (struct sock_filter) {
                 .code = code,
                 .jt = jt,

src/libsystemd/sd-event/sd-event.c

@@ -5077,6 +5077,7 @@ _public_ int sd_event_get_watchdog(sd_event *e) {
 _public_ int sd_event_get_iteration(sd_event *e, uint64_t *ret) {
         assert_return(e, -EINVAL);
         assert_return(e = event_resolve(e), -ENOPKG);
+        assert_return(ret, -EINVAL);
         assert_return(!event_origin_changed(e), -ECHILD);
 
         *ret = e->iteration;

src/libsystemd/sd-id128/id128-util.c

@@ -199,6 +199,8 @@ int id128_write_at(int dir_fd, const char *path, Id128Flag f, sd_id128_t id) {
 }
 
 void id128_hash_func(const sd_id128_t *p, struct siphash *state) {
+        assert(p);
+
         siphash24_compress_typesafe(*p, state);
 }
 

src/libsystemd/sd-journal/journal-file.c

@@ -2107,6 +2107,8 @@ static int link_entry_into_array(
         assert(f->header);
         assert(first);
         assert(idx);
+        POINTER_MAY_BE_NULL(tail);
+        POINTER_MAY_BE_NULL(tidx);
         assert(p > 0);
 
         a = tail ? le32toh(*tail) : le64toh(*first);

src/libsystemd/sd-journal/journal-verify.c

@@ -23,6 +23,8 @@ static void draw_progress(uint64_t p, usec_t *last_usec) {
         unsigned n, i, j, k;
         usec_t z, x;
 
+        assert(last_usec);
+
         if (!on_tty())
                 return;
 

src/libsystemd/sd-journal/test-journal-interleaving.c

@@ -591,6 +591,8 @@ TEST(sequence_numbers) {
 }
 
 static int expected_result(uint64_t needle, const uint64_t *candidates, const uint64_t *offset, size_t n, direction_t direction, uint64_t *ret) {
+        assert(ret);
+
         switch (direction) {
         case DIRECTION_DOWN:
                 for (size_t i = 0; i < n; i++) {
@@ -625,6 +627,8 @@ static int expected_result(uint64_t needle, const uint64_t *candidates, const ui
 }
 
 static int expected_result_next(uint64_t needle, const uint64_t *candidates, const uint64_t *offset, size_t n, direction_t direction, uint64_t *ret) {
+        assert(ret);
+
         switch (direction) {
         case DIRECTION_DOWN:
                 for (size_t i = 0; i < n; i++)

src/libsystemd/sd-netlink/netlink-message-rtnl.c

@@ -385,6 +385,8 @@ int sd_rtnl_message_new_addr_update(
                 int family) {
         int r;
 
+        assert_return(ret, -EINVAL);
+
         r = sd_rtnl_message_new_addr(rtnl, ret, RTM_NEWADDR, ifindex, family);
         if (r < 0)
                 return r;

src/shared/bus-unit-procs.c

@@ -134,6 +134,9 @@ static void remove_cgroup(Hashmap *cgroups, struct CGroupInfo *cg) {
 }
 
 static int cgroup_info_compare_func(struct CGroupInfo * const *a, struct CGroupInfo * const *b) {
+        assert(a);
+        assert(b);
+
         return strcmp((*a)->cgroup_path, (*b)->cgroup_path);
 }
 

src/shared/calendarspec.c

@@ -39,6 +39,7 @@ static CalendarComponent* chain_free(CalendarComponent *c) {
 DEFINE_TRIVIAL_CLEANUP_FUNC(CalendarComponent*, chain_free);
 
 CalendarSpec* calendar_spec_free(CalendarSpec *c) {
+        POINTER_MAY_BE_NULL(c);
 
         if (!c)
                 return NULL;
@@ -57,6 +58,9 @@ CalendarSpec* calendar_spec_free(CalendarSpec *c) {
 static int component_compare(CalendarComponent * const *a, CalendarComponent * const *b) {
         int r;
 
+        assert(a);
+        assert(b);
+
         r = CMP((*a)->start, (*b)->start);
         if (r != 0)
                 return r;
@@ -487,6 +491,10 @@ static int parse_one_number(const char *p, const char **e, unsigned long *ret) {
         char *ee = NULL;
         unsigned long value;
 
+        assert(p);
+        assert(e);
+        assert(ret);
+
         errno = 0;
         value = strtoul(p, &ee, 10);
         if (errno > 0)
@@ -504,6 +512,9 @@ static int parse_component_decimal(const char **p, bool usec, int *res) {
         const char *e = NULL;
         int r;
 
+        assert(p);
+        assert(res);
+
         if (!ascii_isdigit(**p))
                 return -EINVAL;
 
@@ -569,6 +580,8 @@ static int calendarspec_from_time_t(CalendarSpec *c, time_t time) {
         struct tm tm;
         int r;
 
+        assert(c);
+
         if ((usec_t) time > USEC_INFINITY / USEC_PER_SEC)
                 return -ERANGE;
 
@@ -616,9 +629,8 @@ static int calendarspec_from_time_t(CalendarSpec *c, time_t time) {
 static int prepend_component(const char **p, bool usec, unsigned nesting, CalendarComponent **c) {
         int r, start, stop = -1, repeat = 0;
         CalendarComponent *cc;
-        const char *e = *p;
+        const char *e = *ASSERT_PTR(p);
 
-        assert(p);
         assert(c);
 
         if (nesting > CALENDARSPEC_COMPONENTS_MAX)
@@ -1218,6 +1230,8 @@ static bool matches_weekday(int weekdays_bits, const struct tm *tm, bool utc) {
         struct tm t;
         int k;
 
+        assert(tm);
+
         if (weekdays_bits < 0 || weekdays_bits >= BITS_WEEKDAYS)
                 return true;
 

src/shared/condition.c

@@ -82,11 +82,9 @@ Condition* condition_new(ConditionType type, const char *parameter, bool trigger
                 .negate = negate,
         };
 
-        if (parameter) {
-                c->parameter = strdup(parameter);
-                if (!c->parameter)
-                        return mfree(c);
-        }
+        c->parameter = strdup(parameter);
+        if (!c->parameter)
+                return mfree(c);
 
         return c;
 }

src/shared/conf-parser.c

@@ -918,6 +918,8 @@ static int _hashmap_by_section_find_unused_line(
         unsigned n = 0;
         void *entry;
 
+        assert(ret);
+
         HASHMAP_BASE_FOREACH_KEY(entry, cs, entries_by_section) {
                 if (filename && !streq(cs->filename, filename))
                         continue;

src/shared/creds-util.c

@@ -129,6 +129,8 @@ int open_credentials_dir(void) {
 int get_system_credentials_dir(const char **ret) {
         int r;
 
+        assert(ret);
+
         /* Note that for system credentials the environment variable we honour is just for debugging purpose
          * (unlike for the per-service credential path env var where it's key part of the protocol). */
         r = get_credentials_dir_internal("SYSTEMD_SYSTEM_CREDENTIALS_DIRECTORY", ret);
@@ -142,6 +144,8 @@ int get_system_credentials_dir(const char **ret) {
 int get_encrypted_system_credentials_dir(const char **ret) {
         int r;
 
+        assert(ret);
+
         r = get_credentials_dir_internal("SYSTEMD_ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY", ret);
         if (r >= 0 || r != -ENXIO)
                 return r;

src/shared/dns-packet.c

@@ -1473,7 +1473,9 @@ int dns_packet_read_uint8(DnsPacket *p, uint8_t *ret, size_t *start) {
         if (r < 0)
                 return r;
 
-        *ret = ((uint8_t*) d)[0];
+        if (ret)
+                *ret = ((uint8_t*) d)[0];
+
         return 0;
 }
 
@@ -1503,7 +1505,8 @@ int dns_packet_read_uint32(DnsPacket *p, uint32_t *ret, size_t *start) {
         if (r < 0)
                 return r;
 
-        *ret = unaligned_read_be32(d);
+        if (ret)
+                *ret = unaligned_read_be32(d);
 
         return 0;
 }
@@ -2404,6 +2407,7 @@ static bool opt_is_good(DnsResourceRecord *rr, bool *rfc6975) {
          * a reply). */
 
         assert(rr);
+        assert(rfc6975);
         assert(rr->key->type == DNS_TYPE_OPT);
 
         /* Check that the version is 0 */

src/shared/format-table.c

@@ -1543,6 +1543,10 @@ static int cell_data_compare(TableData *a, size_t index_a, TableData *b, size_t
 static int table_data_compare(const size_t *a, const size_t *b, Table *t) {
         int r;
 
+        /* This is called from qsort()s inner loops. Correctly implemented qsort will never pass NULL so we
+           just suppress the check via POINTER_MAY_BE_NULL instead of assert() to avoid the runtime cost. */
+        POINTER_MAY_BE_NULL(a);
+        POINTER_MAY_BE_NULL(b);
         assert(t);
         assert(t->sort_map);
 

src/shared/import-util.c

@@ -142,6 +142,8 @@ int tar_strip_suffixes(const char *name, char **ret) {
         const char *e;
         char *s;
 
+        assert(ret);
+
         e = endswith(name, ".tar");
         if (!e)
                 e = endswith(name, ".tar.xz");
@@ -183,6 +185,8 @@ int raw_strip_suffixes(const char *name, char **ret) {
 
         _cleanup_free_ char *q = NULL;
 
+        assert(ret);
+
         q = strdup(name);
         if (!q)
                 return -ENOMEM;

src/shared/install-printf.c

@@ -49,6 +49,8 @@ static int specifier_instance(char specifier, const void *data, const char *root
         char *instance;
         int r;
 
+        assert(ret);
+
         r = unit_name_to_instance(i->name, &instance);
         if (r < 0)
                 return r;

src/shared/install.c

@@ -646,6 +646,7 @@ static int mark_symlink_for_removal(
         char *n;
         int r;
 
+        assert(remove_symlinks_to);
         assert(p);
 
         r = set_ensure_allocated(remove_symlinks_to, &path_hash_ops_free);
@@ -1037,6 +1038,7 @@ static int find_symlinks_in_scope(
 
         assert(lp);
         assert(info);
+        assert(state);
 
         /* As we iterate over the list of search paths in lp->search_path, we may encounter "same name"
          * symlinks. The ones which are "below" (i.e. have lower priority) than the unit file itself are
@@ -1842,6 +1844,8 @@ static int install_info_discover_and_check(
 
         int r;
 
+        POINTER_MAY_BE_NULL(ret);
+
         r = install_info_discover(ctx, lp, name_or_path, flags, ret, changes, n_changes);
         if (r < 0)
                 return r;
@@ -3510,6 +3514,7 @@ static int query_presets(const char *name, const UnitFilePresets *presets, char
 
         assert(name);
         assert(presets);
+        POINTER_MAY_BE_NULL(instance_name_list);
 
         if (!unit_name_is_valid(name, UNIT_NAME_ANY))
                 return -EINVAL;

src/shared/journal-importer.c

@@ -50,6 +50,8 @@ static int get_line(JournalImporter *imp, char **line, size_t *size) {
         char *c = NULL;
 
         assert(imp);
+        assert(line);
+        assert(size);
         assert(imp->state == IMPORTER_STATE_LINE);
         assert(imp->offset <= imp->filled);
         assert(imp->filled <= MALLOC_SIZEOF_SAFE(imp->buf));

src/shared/local-addresses.c

@@ -53,6 +53,9 @@ bool has_local_address(const struct local_address *addresses, size_t n_addresses
 static void suppress_duplicates(struct local_address *list, size_t *n_list) {
         size_t old_size, new_size;
 
+        POINTER_MAY_BE_NULL(list);
+        assert(n_list);
+
         /* Removes duplicate entries, assumes the list of addresses is already sorted. Updates in-place. */
 
         if (*n_list < 2) /* list with less than two entries can't have duplicates */
@@ -88,6 +91,7 @@ static int add_local_address_full(
         assert(ifindex > 0);
         assert(IN_SET(family, AF_INET, AF_INET6));
         assert(address);
+        POINTER_MAY_BE_NULL(prefsrc);
 
         if (!GREEDY_REALLOC(*list, *n_list + 1))
                 return -ENOMEM;

src/shared/loop-util.c

@@ -33,6 +33,8 @@
 #include "time-util.h"
 
 static void cleanup_clear_loop_close(int *fd) {
+        assert(fd);
+
         if (*fd < 0)
                 return;
 

src/shared/netif-util.c

@@ -40,6 +40,8 @@ int net_get_type_string(sd_device *device, uint16_t iftype, char **ret) {
         const char *t;
         char *p;
 
+        assert(ret);
+
         if (device &&
             sd_device_get_devtype(device, &t) >= 0 &&
             !isempty(t))

src/shared/openssl-util.c

@@ -1339,8 +1339,7 @@ static int openssl_load_private_key_from_file(const char *path, EVP_PKEY **ret)
                 return log_debug_errno(SYNTHETIC_ERRNO(EIO), "Failed to parse PEM private key: %s",
                                        ERR_error_string(ERR_get_error(), NULL));
 
-        if (ret)
-                *ret = TAKE_PTR(pk);
+        *ret = TAKE_PTR(pk);
 
         return 0;
 }
@@ -1404,8 +1403,7 @@ static int load_x509_certificate_from_file(const char *path, X509 **ret) {
                 return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "Failed to parse X.509 certificate: %s",
                                        ERR_error_string(ERR_get_error(), NULL));
 
-        if (ret)
-                *ret = TAKE_PTR(cert);
+        *ret = TAKE_PTR(cert);
 
         return 0;
 }

src/shared/parse-argument.c

@@ -79,6 +79,8 @@ int parse_path_argument(const char *path, bool suppress_root, char **arg) {
         char *p;
         int r;
 
+        assert(arg);
+
         /*
          * This function is intended to be used in command line parsers, to handle paths that are passed
          * in. It makes the path absolute, and reduces it to NULL if omitted or root (the latter optionally).

src/shared/pkcs11-util.c

@@ -874,6 +874,8 @@ int pkcs11_token_find_related_object(
         CK_OBJECT_HANDLE objects[2];
         CK_RV rv;
 
+        assert(ret_object);
+
         rv = m->C_GetAttributeValue(session, prototype, attributes, ELEMENTSOF(attributes));
         if (!IN_SET(rv, CKR_OK, CKR_ATTRIBUTE_TYPE_INVALID))
                 return log_debug_errno(SYNTHETIC_ERRNO(EIO), "Failed to retrieve length of attributes: %s", sym_p11_kit_strerror(rv));
@@ -1072,6 +1074,9 @@ static int pkcs11_token_decrypt_data_ecc(
         int r;
 #endif
 
+        assert(ret_decrypted_data);
+        assert(ret_decrypted_data_size);
+
         rv = m->C_GetSessionInfo(session, &session_info);
         if (rv != CKR_OK)
                 return log_error_errno(SYNTHETIC_ERRNO(EIO),

src/shared/pretty-print.c

@@ -100,6 +100,7 @@ int terminal_urlify(const char *url, const char *text, char **ret) {
         char *n;
 
         assert(url);
+        assert(ret);
 
         /* Takes a URL and a pretty string and formats it as clickable link for the terminal. See
          * https://gist.github.com/egmontkob/eb114294efbcd5adb1944c9f3cb5feda for details. */

src/shared/rm-rf.c

@@ -268,6 +268,8 @@ typedef struct TodoEntry {
 } TodoEntry;
 
 static void free_todo_entries(TodoEntry **todos) {
+        assert(todos);
+
         for (TodoEntry *x = *todos; x && x->dir; x++) {
                 closedir(x->dir);
                 free(x->dirname);

src/shared/socket-netlink.c

@@ -98,6 +98,8 @@ int socket_address_parse_and_warn(SocketAddress *a, const char *s) {
         SocketAddress b;
         int r;
 
+        assert(a);
+
         /* Similar to socket_address_parse() but warns for IPv6 sockets when we don't support them. */
 
         r = socket_address_parse(&b, s);

src/shared/specifier.c

@@ -139,6 +139,8 @@ int specifier_id128(char specifier, const void *data, const char *root, const vo
         const sd_id128_t *id = ASSERT_PTR(data);
         char *n;
 
+        assert(ret);
+
         n = new(char, SD_ID128_STRING_MAX);
         if (!n)
                 return -ENOMEM;
@@ -151,6 +153,8 @@ int specifier_uuid(char specifier, const void *data, const char *root, const voi
         const sd_id128_t *id = ASSERT_PTR(data);
         char *n;
 
+        assert(ret);
+
         n = new(char, SD_ID128_UUID_STRING_MAX);
         if (!n)
                 return -ENOMEM;

src/shared/tests.c

@@ -71,6 +71,8 @@ int get_testdata_dir(const char *suffix, char **ret) {
         const char *dir;
         char *p;
 
+        assert(ret);
+
         load_testdata_env();
 
         /* if the env var is set, use that */

src/shared/tpm2-util.c

@@ -5038,6 +5038,8 @@ static int tpm2_calculate_seal_public(
         int r;
 
         assert(parent);
+        POINTER_MAY_BE_NULL(attributes);
+        POINTER_MAY_BE_NULL(policy);
         assert(seed);
         assert(secret);
         assert(ret);

src/shared/vlan-util.c

@@ -26,6 +26,9 @@ int parse_vid_range(const char *p, uint16_t *vid, uint16_t *vid_end) {
         unsigned lower, upper;
         int r;
 
+        assert(vid);
+        assert(vid_end);
+
         r = parse_range(p, &lower, &upper);
         if (r < 0)
                 return r;

src/sysext/sysext.c

@@ -2437,8 +2437,7 @@ static int image_discover_and_read_metadata(ImageClass image_class, Hashmap **re
                         return log_error_errno(r, "Failed to read metadata for image %s: %m", img->name);
         }
 
-        if (ret_images)
-                *ret_images = TAKE_PTR(images);
+        *ret_images = TAKE_PTR(images);
 
         return 0;
 }