lkml.org 
[lkml]   [2012]   [Jul]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: New Defects based on recent changes in Kernel code found by Coverity Scan
    On Thu, 5 Jul 2012 11:33:16 -0400 Chris Mason <chris.mason@fusionio.com> wrote:

    > > > * CID 709112: Dereference after null check - fs/btrfs/ioctl.c, line: 1309 Comparing "device->fs_devices" to null implies that "device->fs_devices" might be null, and then it is deference
    > > > fs/btrfs/ioctl.c:1309
    > >
    > > Chris.
    >
    > Thanks for forwarding this. But I'm a little confused, our line 1309 is
    > this:
    >
    > if (device->fs_devices && device->fs_devices->seeding) {
    >
    > Is coverity telling me that I'm using fs_devices later on in the
    > function without extra checks? Some functions we call do assume it
    > isn't null, but the seeding devices are special snowflakes.

    There were more details further down in the email:

    > ____________________________________________________________________________________________________________
    > CID 709112: Dereference after null check
    >
    > fs/btrfs/ioctl.c:1309
    > 1256 static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
    > 1257 void __user *arg)
    > 1258 {
    > ...
    > >>> At conditional (1): "device->fs_devices" taking the false branch.
    > >>> CID 709112: Dereference after null check (FORWARD_NULL) Comparing "device->fs_devices" to null implies that "device->fs_devices" might be null.
    > 1309 if (device->fs_devices && device->fs_devices->seeding) {
    > 1310 printk(KERN_INFO "btrfs: resizer unable to apply on "
    > 1311 "seeding device %llu\n", devid);
    > 1312 ret = -EINVAL;
    > 1313 goto out_free;
    > 1314 }
    > ...
    > >>> Passing null variable "device->fs_devices" to function "btrfs_grow_device", which dereferences it.
    > 1367 ret = btrfs_grow_device(trans, device, new_size);
    > 1368 btrfs_commit_transaction(trans, root);
    > 1369 } else if (new_size < old_size) {
    > >>> Passing null variable "device->fs_devices" to function "btrfs_shrink_device", which dereferences it.
    > 1370 ret = btrfs_shrink_device(device, new_size);
    > 1371 }
    > 1378 }


    \
     
     \ /
      Last update: 2012-07-05 22:41    [W:0.031 / U:30.440 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site