lkml.org 
[lkml]   [2013]   [Nov]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
Subject[RFC] Coverity 1128444 - Dereference after null check (FORWARD_NULL) in glock.c
From
Hello,

Coverity detected in 'fs/gfs2/glock.c' a possible dereference after
null check. Maybe a positive one.

There is a initial check for possible 'gl' NULL. After that 'gl' is
dereferenced in the looping check by __lockref_is_dead().

What do you think?


1875static int gfs2_glock_iter_next(struct gfs2_glock_iter *gi)
1876{
1877 struct gfs2_glock *gl;
1878
1879 do {
1880 gl = gi->gl;

1. Condition "gl", taking false branch

2. var_compare_op: Comparing "gl" to null implies that "gl" might be null.
1881 if (gl) {
1882 gi->gl = glock_hash_next(gl);
1883 gi->nhash++;
1884 } else {

3. Condition "gi->hash >= (32768 /* 1 << 15 */)", taking false branch
1885 if (gi->hash >= GFS2_GL_HASH_SIZE) {
1886 rcu_read_unlock();
1887 return 1;
1888 }
1889 gi->gl = glock_hash_chain(gi->hash);
1890 gi->nhash = 0;
1891 }

4. Condition "gi->gl == NULL", taking true branch

7. Condition "gi->gl == NULL", taking false branch
1892 while (gi->gl == NULL) {
1893 gi->hash++;

5. Condition "gi->hash >= (32768 /* 1 << 15 */)", taking false branch
1894 if (gi->hash >= GFS2_GL_HASH_SIZE) {
1895 rcu_read_unlock();
1896 return 1;
1897 }
1898 gi->gl = glock_hash_chain(gi->hash);
1899 gi->nhash = 0;

6. Jumping back to the beginning of the loop
1900 }
1901 /* Skip entries for other sb and dead entries */

8. Condition "gi->sdp != gi->gl->gl_sbd", taking false branch

CID 1128444 (#1 of 1): Dereference after null check (FORWARD_NULL)9.
var_deref_model: Passing null pointer "&gl->gl_lockref" to function
"__lockref_is_dead(struct lockref const *)", which dereferences
it.[show details]
1902 } while (gi->sdp != gi->gl->gl_sbd ||
__lockref_is_dead(&gl->gl_lockref));
1903
1904 return 0;
1905}

--
Regards,

Geyslan G. Bem
hackingbits.com


\
 
 \ /
  Last update: 2013-11-12 18:21    [W:0.049 / U:1.204 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site