linux-kernel - Re: [PATCH] scsi: target: configfs: Remove redundant assignment to ret

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 30 Apr 2021 16:29:11 +0200
From:   Bodo Stroesser <bostroesser@...il.com>
To:     Jiapeng Chong <jiapeng.chong@...ux.alibaba.com>,
        martin.petersen@...cle.com
Cc:     linux-scsi@...r.kernel.org, target-devel@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] scsi: target: configfs: Remove redundant assignment to
 ret

On 30.04.21 11:23, Jiapeng Chong wrote:
> Variable ret is set to '-EINVAL' but this value is never read as it is
> overwritten later on, hence it is a redundant assignment and can be
> removed.
> 
> Clean up the following clang-analyzer warning:
> 
> drivers/target/target_core_configfs.c:2037:5: warning: Value stored to
> 'ret' is never read [clang-analyzer-deadcode.DeadStores].
> 
> drivers/target/target_core_configfs.c:1973:5: warning: Value stored to
> 'ret' is never read [clang-analyzer-deadcode.DeadStores].
> 
> drivers/target/target_core_configfs.c:1959:5: warning: Value stored to
> 'ret' is never read [clang-analyzer-deadcode.DeadStores].
> 
> Reported-by: Abaci Robot <abaci@...ux.alibaba.com>
> Signed-off-by: Jiapeng Chong <jiapeng.chong@...ux.alibaba.com>
> ---
>   drivers/target/target_core_configfs.c | 3 ---
>   1 file changed, 3 deletions(-)
> 
> diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
> index 4b2e493..bda05c3 100644
> --- a/drivers/target/target_core_configfs.c
> +++ b/drivers/target/target_core_configfs.c
> @@ -1956,7 +1956,6 @@ static ssize_t target_pr_res_aptpl_metadata_store(struct config_item *item,
>   				pr_err("APTPL metadata initiator_node="
>   					" exceeds PR_APTPL_MAX_IPORT_LEN: %d\n",
>   					PR_APTPL_MAX_IPORT_LEN);
> -				ret = -EINVAL;
>   				break;
>   			}
>   			break;
> @@ -1970,7 +1969,6 @@ static ssize_t target_pr_res_aptpl_metadata_store(struct config_item *item,
>   				pr_err("APTPL metadata initiator_isid"
>   					"= exceeds PR_REG_ISID_LEN: %d\n",
>   					PR_REG_ISID_LEN);
> -				ret = -EINVAL;
>   				break;
>   			}
>   			break;
> @@ -2034,7 +2032,6 @@ static ssize_t target_pr_res_aptpl_metadata_store(struct config_item *item,
>   				pr_err("APTPL metadata target_node="
>   					" exceeds PR_APTPL_MAX_TPORT_LEN: %d\n",
>   					PR_APTPL_MAX_TPORT_LEN);
> -				ret = -EINVAL;
>   				break;
>   			}
>   			break;
> 

I don't think storing -EINVAL in ret is wrong. But maybe the "break" in
the next line should better be "goto out"?

AFAICS, the "break" finally leads to calling
core_scsi3_alloc_aptpl_registration () despite a too long string in
i_port, isid or t_port. Is this behaviour intentional?

BTW: why is "initiator_sid" input handled as string?
core_scsi3_alloc_aptpl_registration later calls get_unaligned_be64 for
that string. I don't think this makes sense.

Finally, I think there is a possible memory leak. If the input written
to res_aptpl_metadata for example contains "initiator_sid=xxxxx" more
than once, a previously created string isid ("isid = match_strdup(args)")
is not freed before it is overwritten in the loop. The same is true for
all tokens handled with match_strdup.