Messages in this thread | | | Date | Tue, 12 Nov 2013 12:53:09 -0200 | Subject | [RFC] Coverity 1128444 - Dereference after null check (FORWARD_NULL) in glock.c | From | Geyslan Gregório Bem <> |
| |
Hello,
Coverity detected in 'fs/gfs2/glock.c' a possible dereference after null check. Maybe a positive one.
There is a initial check for possible 'gl' NULL. After that 'gl' is dereferenced in the looping check by __lockref_is_dead().
What do you think?
1875static int gfs2_glock_iter_next(struct gfs2_glock_iter *gi) 1876{ 1877 struct gfs2_glock *gl; 1878 1879 do { 1880 gl = gi->gl;
1. Condition "gl", taking false branch
2. var_compare_op: Comparing "gl" to null implies that "gl" might be null. 1881 if (gl) { 1882 gi->gl = glock_hash_next(gl); 1883 gi->nhash++; 1884 } else {
3. Condition "gi->hash >= (32768 /* 1 << 15 */)", taking false branch 1885 if (gi->hash >= GFS2_GL_HASH_SIZE) { 1886 rcu_read_unlock(); 1887 return 1; 1888 } 1889 gi->gl = glock_hash_chain(gi->hash); 1890 gi->nhash = 0; 1891 }
4. Condition "gi->gl == NULL", taking true branch
7. Condition "gi->gl == NULL", taking false branch 1892 while (gi->gl == NULL) { 1893 gi->hash++;
5. Condition "gi->hash >= (32768 /* 1 << 15 */)", taking false branch 1894 if (gi->hash >= GFS2_GL_HASH_SIZE) { 1895 rcu_read_unlock(); 1896 return 1; 1897 } 1898 gi->gl = glock_hash_chain(gi->hash); 1899 gi->nhash = 0;
6. Jumping back to the beginning of the loop 1900 } 1901 /* Skip entries for other sb and dead entries */
8. Condition "gi->sdp != gi->gl->gl_sbd", taking false branch
CID 1128444 (#1 of 1): Dereference after null check (FORWARD_NULL)9. var_deref_model: Passing null pointer "&gl->gl_lockref" to function "__lockref_is_dead(struct lockref const *)", which dereferences it.[show details] 1902 } while (gi->sdp != gi->gl->gl_sbd || __lockref_is_dead(&gl->gl_lockref)); 1903 1904 return 0; 1905}
-- Regards,
Geyslan G. Bem hackingbits.com
| |