[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20120705124426.c4a2f347.akpm@linux-foundation.org>
Date: Thu, 5 Jul 2012 12:44:26 -0700
From: Andrew Morton <akpm@...ux-foundation.org>
To: Chris Mason <chris.mason@...ionio.com>
Cc: Scan Subscription <scan-subscription@...erity.com>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"linux-scsi@...r.kernel.org" <linux-scsi@...r.kernel.org>,
"Chris L. Mason" <clmason@...ionio.com>,
Bing Zhao <bzhao@...vell.com>,
Robert Love <robert.w.love@...el.com>,
Andrew Vasquez <andrew.vasquez@...gic.com>,
"Theodore Ts'o" <tytso@....edu>,
"linux-ext4@...r.kernel.org" <linux-ext4@...r.kernel.org>,
Mattia Dongili <malattia@...ux.it>,
Matthew Garrett <mjg@...hat.com>
Subject: Re: New Defects based on recent changes in Kernel code found by
Coverity Scan
On Thu, 5 Jul 2012 11:33:16 -0400 Chris Mason <chris.mason@...ionio.com> wrote:
> > > * CID 709112: Dereference after null check - fs/btrfs/ioctl.c, line: 1309 Comparing "device->fs_devices" to null implies that "device->fs_devices" might be null, and then it is deference
> > > fs/btrfs/ioctl.c:1309
> >
> > Chris.
>
> Thanks for forwarding this. But I'm a little confused, our line 1309 is
> this:
>
> if (device->fs_devices && device->fs_devices->seeding) {
>
> Is coverity telling me that I'm using fs_devices later on in the
> function without extra checks? Some functions we call do assume it
> isn't null, but the seeding devices are special snowflakes.
There were more details further down in the email:
> ____________________________________________________________________________________________________________
> CID 709112: Dereference after null check
>
> fs/btrfs/ioctl.c:1309
> 1256 static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
> 1257 void __user *arg)
> 1258 {
> ...
> >>> At conditional (1): "device->fs_devices" taking the false branch.
> >>> CID 709112: Dereference after null check (FORWARD_NULL) Comparing "device->fs_devices" to null implies that "device->fs_devices" might be null.
> 1309 if (device->fs_devices && device->fs_devices->seeding) {
> 1310 printk(KERN_INFO "btrfs: resizer unable to apply on "
> 1311 "seeding device %llu\n", devid);
> 1312 ret = -EINVAL;
> 1313 goto out_free;
> 1314 }
> ...
> >>> Passing null variable "device->fs_devices" to function "btrfs_grow_device", which dereferences it.
> 1367 ret = btrfs_grow_device(trans, device, new_size);
> 1368 btrfs_commit_transaction(trans, root);
> 1369 } else if (new_size < old_size) {
> >>> Passing null variable "device->fs_devices" to function "btrfs_shrink_device", which dereferences it.
> 1370 ret = btrfs_shrink_device(device, new_size);
> 1371 }
> 1378 }
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists