* [RFC] Coverity 1128444 - Dereference after null check (FORWARD_NULL) in glock.c
@ 2013-11-12 14:53 Geyslan Gregório Bem
2013-11-12 14:55 ` Steven Whitehouse
0 siblings, 1 reply; 3+ messages in thread
From: Geyslan Gregório Bem @ 2013-11-12 14:53 UTC (permalink / raw)
To: swhiteho; +Cc: cluster-devel, LKML
Hello,
Coverity detected in 'fs/gfs2/glock.c' a possible dereference after
null check. Maybe a positive one.
There is a initial check for possible 'gl' NULL. After that 'gl' is
dereferenced in the looping check by __lockref_is_dead().
What do you think?
1875static int gfs2_glock_iter_next(struct gfs2_glock_iter *gi)
1876{
1877 struct gfs2_glock *gl;
1878
1879 do {
1880 gl = gi->gl;
1. Condition "gl", taking false branch
2. var_compare_op: Comparing "gl" to null implies that "gl" might be null.
1881 if (gl) {
1882 gi->gl = glock_hash_next(gl);
1883 gi->nhash++;
1884 } else {
3. Condition "gi->hash >= (32768 /* 1 << 15 */)", taking false branch
1885 if (gi->hash >= GFS2_GL_HASH_SIZE) {
1886 rcu_read_unlock();
1887 return 1;
1888 }
1889 gi->gl = glock_hash_chain(gi->hash);
1890 gi->nhash = 0;
1891 }
4. Condition "gi->gl == NULL", taking true branch
7. Condition "gi->gl == NULL", taking false branch
1892 while (gi->gl == NULL) {
1893 gi->hash++;
5. Condition "gi->hash >= (32768 /* 1 << 15 */)", taking false branch
1894 if (gi->hash >= GFS2_GL_HASH_SIZE) {
1895 rcu_read_unlock();
1896 return 1;
1897 }
1898 gi->gl = glock_hash_chain(gi->hash);
1899 gi->nhash = 0;
6. Jumping back to the beginning of the loop
1900 }
1901 /* Skip entries for other sb and dead entries */
8. Condition "gi->sdp != gi->gl->gl_sbd", taking false branch
CID 1128444 (#1 of 1): Dereference after null check (FORWARD_NULL)9.
var_deref_model: Passing null pointer "&gl->gl_lockref" to function
"__lockref_is_dead(struct lockref const *)", which dereferences
it.[show details]
1902 } while (gi->sdp != gi->gl->gl_sbd ||
__lockref_is_dead(&gl->gl_lockref));
1903
1904 return 0;
1905}
--
Regards,
Geyslan G. Bem
hackingbits.com
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [RFC] Coverity 1128444 - Dereference after null check (FORWARD_NULL) in glock.c
2013-11-12 14:53 [RFC] Coverity 1128444 - Dereference after null check (FORWARD_NULL) in glock.c Geyslan Gregório Bem
@ 2013-11-12 14:55 ` Steven Whitehouse
2013-11-12 14:58 ` Geyslan Gregório Bem
0 siblings, 1 reply; 3+ messages in thread
From: Steven Whitehouse @ 2013-11-12 14:55 UTC (permalink / raw)
To: Geyslan Gregório Bem; +Cc: cluster-devel, LKML
Hi,
On Tue, 2013-11-12 at 12:53 -0200, Geyslan Gregório Bem wrote:
> Hello,
>
> Coverity detected in 'fs/gfs2/glock.c' a possible dereference after
> null check. Maybe a positive one.
>
> There is a initial check for possible 'gl' NULL. After that 'gl' is
> dereferenced in the looping check by __lockref_is_dead().
>
> What do you think?
>
I've already been sent a patch for that, and its in the GFS2 -fixes
tree. Thanks,
Steve.
>
> 1875static int gfs2_glock_iter_next(struct gfs2_glock_iter *gi)
> 1876{
> 1877 struct gfs2_glock *gl;
> 1878
> 1879 do {
> 1880 gl = gi->gl;
>
> 1. Condition "gl", taking false branch
>
> 2. var_compare_op: Comparing "gl" to null implies that "gl" might be null.
> 1881 if (gl) {
> 1882 gi->gl = glock_hash_next(gl);
> 1883 gi->nhash++;
> 1884 } else {
>
> 3. Condition "gi->hash >= (32768 /* 1 << 15 */)", taking false branch
> 1885 if (gi->hash >= GFS2_GL_HASH_SIZE) {
> 1886 rcu_read_unlock();
> 1887 return 1;
> 1888 }
> 1889 gi->gl = glock_hash_chain(gi->hash);
> 1890 gi->nhash = 0;
> 1891 }
>
> 4. Condition "gi->gl == NULL", taking true branch
>
> 7. Condition "gi->gl == NULL", taking false branch
> 1892 while (gi->gl == NULL) {
> 1893 gi->hash++;
>
> 5. Condition "gi->hash >= (32768 /* 1 << 15 */)", taking false branch
> 1894 if (gi->hash >= GFS2_GL_HASH_SIZE) {
> 1895 rcu_read_unlock();
> 1896 return 1;
> 1897 }
> 1898 gi->gl = glock_hash_chain(gi->hash);
> 1899 gi->nhash = 0;
>
> 6. Jumping back to the beginning of the loop
> 1900 }
> 1901 /* Skip entries for other sb and dead entries */
>
> 8. Condition "gi->sdp != gi->gl->gl_sbd", taking false branch
>
> CID 1128444 (#1 of 1): Dereference after null check (FORWARD_NULL)9.
> var_deref_model: Passing null pointer "&gl->gl_lockref" to function
> "__lockref_is_dead(struct lockref const *)", which dereferences
> it.[show details]
> 1902 } while (gi->sdp != gi->gl->gl_sbd ||
> __lockref_is_dead(&gl->gl_lockref));
> 1903
> 1904 return 0;
> 1905}
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [RFC] Coverity 1128444 - Dereference after null check (FORWARD_NULL) in glock.c
2013-11-12 14:55 ` Steven Whitehouse
@ 2013-11-12 14:58 ` Geyslan Gregório Bem
0 siblings, 0 replies; 3+ messages in thread
From: Geyslan Gregório Bem @ 2013-11-12 14:58 UTC (permalink / raw)
To: Steven Whitehouse; +Cc: cluster-devel, LKML
2013/11/12 Steven Whitehouse <swhiteho@redhat.com>:
> Hi,
>
> On Tue, 2013-11-12 at 12:53 -0200, Geyslan Gregório Bem wrote:
>> Hello,
>>
>> Coverity detected in 'fs/gfs2/glock.c' a possible dereference after
>> null check. Maybe a positive one.
>>
>> There is a initial check for possible 'gl' NULL. After that 'gl' is
>> dereferenced in the looping check by __lockref_is_dead().
>>
>> What do you think?
>>
> I've already been sent a patch for that, and its in the GFS2 -fixes
> tree. Thanks,
>
> Steve.
Steve, thanks.
I'll close it in Coverity.
>
>>
>> 1875static int gfs2_glock_iter_next(struct gfs2_glock_iter *gi)
>> 1876{
>> 1877 struct gfs2_glock *gl;
>> 1878
>> 1879 do {
>> 1880 gl = gi->gl;
>>
>> 1. Condition "gl", taking false branch
>>
>> 2. var_compare_op: Comparing "gl" to null implies that "gl" might be null.
>> 1881 if (gl) {
>> 1882 gi->gl = glock_hash_next(gl);
>> 1883 gi->nhash++;
>> 1884 } else {
>>
>> 3. Condition "gi->hash >= (32768 /* 1 << 15 */)", taking false branch
>> 1885 if (gi->hash >= GFS2_GL_HASH_SIZE) {
>> 1886 rcu_read_unlock();
>> 1887 return 1;
>> 1888 }
>> 1889 gi->gl = glock_hash_chain(gi->hash);
>> 1890 gi->nhash = 0;
>> 1891 }
>>
>> 4. Condition "gi->gl == NULL", taking true branch
>>
>> 7. Condition "gi->gl == NULL", taking false branch
>> 1892 while (gi->gl == NULL) {
>> 1893 gi->hash++;
>>
>> 5. Condition "gi->hash >= (32768 /* 1 << 15 */)", taking false branch
>> 1894 if (gi->hash >= GFS2_GL_HASH_SIZE) {
>> 1895 rcu_read_unlock();
>> 1896 return 1;
>> 1897 }
>> 1898 gi->gl = glock_hash_chain(gi->hash);
>> 1899 gi->nhash = 0;
>>
>> 6. Jumping back to the beginning of the loop
>> 1900 }
>> 1901 /* Skip entries for other sb and dead entries */
>>
>> 8. Condition "gi->sdp != gi->gl->gl_sbd", taking false branch
>>
>> CID 1128444 (#1 of 1): Dereference after null check (FORWARD_NULL)9.
>> var_deref_model: Passing null pointer "&gl->gl_lockref" to function
>> "__lockref_is_dead(struct lockref const *)", which dereferences
>> it.[show details]
>> 1902 } while (gi->sdp != gi->gl->gl_sbd ||
>> __lockref_is_dead(&gl->gl_lockref));
>> 1903
>> 1904 return 0;
>> 1905}
>>
>
>
--
Regards,
Geyslan G. Bem
hackingbits.com
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-11-12 14:58 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-11-12 14:53 [RFC] Coverity 1128444 - Dereference after null check (FORWARD_NULL) in glock.c Geyslan Gregório Bem
2013-11-12 14:55 ` Steven Whitehouse
2013-11-12 14:58 ` Geyslan Gregório Bem
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®