lkml.org 
[lkml]   [2021]   [Jul]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: potential null pointer deference (or maybe invalid null check) in io_uring io_poll_remove_double()
From
Date
On 7/9/21 5:55 AM, Colin Ian King wrote:
> Hi Jens,
>
> I was triaging some outstanding Coverity static analysis warnings and
> found a potential issue in the following commit:
>
> commit 807abcb0883439af5ead73f3308310453b97b624
> Author: Jens Axboe <axboe@kernel.dk>
> Date: Fri Jul 17 17:09:27 2020 -0600
>
> io_uring: ensure double poll additions work with both request types
>
> The analysis from Coverity is as follows:
>
> 4962 static int io_poll_double_wake(struct wait_queue_entry *wait,
> unsigned mode,
> 4963 int sync, void *key)
> 4964 {
> 4965 struct io_kiocb *req = wait->private;
> 4966 struct io_poll_iocb *poll = io_poll_get_single(req);
> 4967 __poll_t mask = key_to_poll(key);
> 4968
> 4969 /* for instances that support it check for an event match
> first: */
>
> deref_ptr: Directly dereferencing pointer poll.
>
> 4970 if (mask && !(mask & poll->events))
> 4971 return 0;
> 4972 if (!(poll->events & EPOLLONESHOT))
> 4973 return poll->wait.func(&poll->wait, mode, sync, key);
> 4974
> 4975 list_del_init(&wait->entry);
> 4976
>
> Dereference before null check (REVERSE_INULL)
> check_after_deref: Null-checking poll suggests that it may be null,
> but it has already been dereferenced on all paths leading to the check.
>
> 4977 if (poll && poll->head) {
> 4978 bool done;
>
> pointer poll is being dereferenced on line 4970, however, on line 4977
> it is being null checked. Either the null check is redundant (because it
> can never be null) or it needs to be performed before the poll->events
> read on line 4970.

I think it's dead code, originally copied from the single poll wake
side. The 'poll' non-zero check should just go.

--
Jens Axboe

\
 
 \ /
  Last update: 2021-07-09 16:20    [W:0.050 / U:0.156 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site