From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Date: Sat, 27 Mar 2010 14:59:50 +0000 Subject: [patch] drbd: potential null dereference Message-Id: <20100327145950.GG5069@bicker> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Lars Ellenberg Cc: Jens Axboe , Philipp Reisner , drbd-user@lists.linbit.com, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org If "e" is NULL then "bm_ext" would be NULL too. Signed-off-by: Dan Carpenter --- Found by static analysis and compile tested only. Sorry. :/ diff --git a/drivers/block/drbd/drbd_actlog.c b/drivers/block/drbd/drbd_actlog.c index 17956ff..b68b778 100644 --- a/drivers/block/drbd/drbd_actlog.c +++ b/drivers/block/drbd/drbd_actlog.c @@ -1328,7 +1328,7 @@ int drbd_rs_del_all(struct drbd_conf *mdev) for (i = 0; i < mdev->resync->nr_elements; i++) { e = lc_element_by_index(mdev->resync, i); bm_ext = e ? lc_entry(e, struct bm_extent, lce) : NULL; - if (bm_ext->lce.lc_number = LC_FREE) + if (!bm_ext || bm_ext->lce.lc_number = LC_FREE) continue; if (bm_ext->lce.lc_number = mdev->resync_wenr) { dev_info(DEV, "dropping %u in drbd_rs_del_all, apparently" From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from racke (bk1.linbit [10.9.9.6]) by mail09.linbit.com (LINBIT Mail Daemon) with ESMTP id 05FEB105B393 for ; Mon, 29 Mar 2010 14:28:05 +0200 (CEST) Resent-Message-ID: <20100329122805.GB3486@racke> Date: Sat, 27 Mar 2010 17:59:50 +0300 From: Dan Carpenter To: Lars Ellenberg Message-ID: <20100327145950.GG5069@bicker> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Cc: linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, Philipp Reisner , drbd-user@lists.linbit.com, Jens Axboe Subject: [Drbd-dev] [patch] drbd: potential null dereference List-Id: Coordination of development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , If "e" is NULL then "bm_ext" would be NULL too. Signed-off-by: Dan Carpenter --- Found by static analysis and compile tested only. Sorry. :/ diff --git a/drivers/block/drbd/drbd_actlog.c b/drivers/block/drbd/drbd_actlog.c index 17956ff..b68b778 100644 --- a/drivers/block/drbd/drbd_actlog.c +++ b/drivers/block/drbd/drbd_actlog.c @@ -1328,7 +1328,7 @@ int drbd_rs_del_all(struct drbd_conf *mdev) for (i = 0; i < mdev->resync->nr_elements; i++) { e = lc_element_by_index(mdev->resync, i); bm_ext = e ? lc_entry(e, struct bm_extent, lce) : NULL; - if (bm_ext->lce.lc_number == LC_FREE) + if (!bm_ext || bm_ext->lce.lc_number == LC_FREE) continue; if (bm_ext->lce.lc_number == mdev->resync_wenr) { dev_info(DEV, "dropping %u in drbd_rs_del_all, apparently" From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753468Ab0C0PAF (ORCPT ); Sat, 27 Mar 2010 11:00:05 -0400 Received: from mail-bw0-f209.google.com ([209.85.218.209]:36285 "EHLO mail-bw0-f209.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752195Ab0C0PAB (ORCPT ); Sat, 27 Mar 2010 11:00:01 -0400 DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:mail-followup-to:mime-version :content-type:content-disposition:user-agent; b=l8Qms+7XxTRvvm/bg2YJz1dZE1iD7ruQohQ+oCosmssKgiECjdjkstyA5br2SI1WsB 9WF8Tmotgk8xAx1IYjuMIoHJRX/gY82BsEEQTx3gqT1GNDRr4jl/rD1Qk6u5i1b5Vec9 4drS1lEMuLlw2Yat4JlUEAcM2aI2KY4ztF+rI= Date: Sat, 27 Mar 2010 17:59:50 +0300 From: Dan Carpenter To: Lars Ellenberg Cc: Jens Axboe , Philipp Reisner , drbd-user@lists.linbit.com, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] drbd: potential null dereference Message-ID: <20100327145950.GG5069@bicker> Mail-Followup-To: Dan Carpenter , Lars Ellenberg , Jens Axboe , Philipp Reisner , drbd-user@lists.linbit.com, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If "e" is NULL then "bm_ext" would be NULL too. Signed-off-by: Dan Carpenter --- Found by static analysis and compile tested only. Sorry. :/ diff --git a/drivers/block/drbd/drbd_actlog.c b/drivers/block/drbd/drbd_actlog.c index 17956ff..b68b778 100644 --- a/drivers/block/drbd/drbd_actlog.c +++ b/drivers/block/drbd/drbd_actlog.c @@ -1328,7 +1328,7 @@ int drbd_rs_del_all(struct drbd_conf *mdev) for (i = 0; i < mdev->resync->nr_elements; i++) { e = lc_element_by_index(mdev->resync, i); bm_ext = e ? lc_entry(e, struct bm_extent, lce) : NULL; - if (bm_ext->lce.lc_number == LC_FREE) + if (!bm_ext || bm_ext->lce.lc_number == LC_FREE) continue; if (bm_ext->lce.lc_number == mdev->resync_wenr) { dev_info(DEV, "dropping %u in drbd_rs_del_all, apparently"