* [patch] drbd: potential null dereference
@ 2010-03-27 14:59 ` Dan Carpenter
0 siblings, 0 replies; 10+ messages in thread
From: Dan Carpenter @ 2010-03-27 14:59 UTC (permalink / raw)
To: Lars Ellenberg
Cc: Jens Axboe, Philipp Reisner, drbd-user, linux-kernel,
kernel-janitors
If "e" is NULL then "bm_ext" would be NULL too.
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
Found by static analysis and compile tested only. Sorry. :/
diff --git a/drivers/block/drbd/drbd_actlog.c b/drivers/block/drbd/drbd_actlog.c
index 17956ff..b68b778 100644
--- a/drivers/block/drbd/drbd_actlog.c
+++ b/drivers/block/drbd/drbd_actlog.c
@@ -1328,7 +1328,7 @@ int drbd_rs_del_all(struct drbd_conf *mdev)
for (i = 0; i < mdev->resync->nr_elements; i++) {
e = lc_element_by_index(mdev->resync, i);
bm_ext = e ? lc_entry(e, struct bm_extent, lce) : NULL;
- if (bm_ext->lce.lc_number = LC_FREE)
+ if (!bm_ext || bm_ext->lce.lc_number = LC_FREE)
continue;
if (bm_ext->lce.lc_number = mdev->resync_wenr) {
dev_info(DEV, "dropping %u in drbd_rs_del_all, apparently"
^ permalink raw reply related [flat|nested] 10+ messages in thread* [patch] drbd: potential null dereference
@ 2010-03-27 14:59 ` Dan Carpenter
0 siblings, 0 replies; 10+ messages in thread
From: Dan Carpenter @ 2010-03-27 14:59 UTC (permalink / raw)
To: Lars Ellenberg
Cc: Jens Axboe, Philipp Reisner, drbd-user, linux-kernel,
kernel-janitors
If "e" is NULL then "bm_ext" would be NULL too.
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
Found by static analysis and compile tested only. Sorry. :/
diff --git a/drivers/block/drbd/drbd_actlog.c b/drivers/block/drbd/drbd_actlog.c
index 17956ff..b68b778 100644
--- a/drivers/block/drbd/drbd_actlog.c
+++ b/drivers/block/drbd/drbd_actlog.c
@@ -1328,7 +1328,7 @@ int drbd_rs_del_all(struct drbd_conf *mdev)
for (i = 0; i < mdev->resync->nr_elements; i++) {
e = lc_element_by_index(mdev->resync, i);
bm_ext = e ? lc_entry(e, struct bm_extent, lce) : NULL;
- if (bm_ext->lce.lc_number == LC_FREE)
+ if (!bm_ext || bm_ext->lce.lc_number == LC_FREE)
continue;
if (bm_ext->lce.lc_number == mdev->resync_wenr) {
dev_info(DEV, "dropping %u in drbd_rs_del_all, apparently"
^ permalink raw reply related [flat|nested] 10+ messages in thread* [Drbd-dev] [patch] drbd: potential null dereference
@ 2010-03-27 14:59 ` Dan Carpenter
0 siblings, 0 replies; 10+ messages in thread
From: Dan Carpenter @ 2010-03-27 14:59 UTC (permalink / raw)
To: Lars Ellenberg
Cc: linux-kernel, kernel-janitors, Philipp Reisner, drbd-user,
Jens Axboe
If "e" is NULL then "bm_ext" would be NULL too.
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
Found by static analysis and compile tested only. Sorry. :/
diff --git a/drivers/block/drbd/drbd_actlog.c b/drivers/block/drbd/drbd_actlog.c
index 17956ff..b68b778 100644
--- a/drivers/block/drbd/drbd_actlog.c
+++ b/drivers/block/drbd/drbd_actlog.c
@@ -1328,7 +1328,7 @@ int drbd_rs_del_all(struct drbd_conf *mdev)
for (i = 0; i < mdev->resync->nr_elements; i++) {
e = lc_element_by_index(mdev->resync, i);
bm_ext = e ? lc_entry(e, struct bm_extent, lce) : NULL;
- if (bm_ext->lce.lc_number == LC_FREE)
+ if (!bm_ext || bm_ext->lce.lc_number == LC_FREE)
continue;
if (bm_ext->lce.lc_number == mdev->resync_wenr) {
dev_info(DEV, "dropping %u in drbd_rs_del_all, apparently"
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [patch] drbd: potential null dereference
2010-03-27 14:59 ` [Drbd-dev] " Dan Carpenter
(?)
@ 2010-04-01 8:56 ` Philipp Reisner
-1 siblings, 0 replies; 10+ messages in thread
From: Philipp Reisner @ 2010-04-01 8:56 UTC (permalink / raw)
To: Dan Carpenter
Cc: Lars Ellenberg, Jens Axboe, Philipp Reisner, drbd-dev,
linux-kernel, kernel-janitors
Hi Dan,
Thanks for the work with the static analyzer, but the patch is
bogus. The lc_element_by_index() function causes a BUG_ON before
returning a NULL. The next mail contains a patch that removes
the unnecessary conditional expression operator.
Philipp Reisner (1):
drbd: lc_element_by_index() never returns NULL
drivers/block/drbd/drbd_actlog.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [patch] drbd: potential null dereference
@ 2010-04-01 8:56 ` Philipp Reisner
0 siblings, 0 replies; 10+ messages in thread
From: Philipp Reisner @ 2010-04-01 8:56 UTC (permalink / raw)
To: Dan Carpenter
Cc: Lars Ellenberg, Jens Axboe, Philipp Reisner, drbd-dev,
linux-kernel, kernel-janitors
Hi Dan,
Thanks for the work with the static analyzer, but the patch is
bogus. The lc_element_by_index() function causes a BUG_ON before
returning a NULL. The next mail contains a patch that removes
the unnecessary conditional expression operator.
Philipp Reisner (1):
drbd: lc_element_by_index() never returns NULL
drivers/block/drbd/drbd_actlog.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [Drbd-dev] [patch] drbd: potential null dereference
@ 2010-04-01 8:56 ` Philipp Reisner
0 siblings, 0 replies; 10+ messages in thread
From: Philipp Reisner @ 2010-04-01 8:56 UTC (permalink / raw)
To: Dan Carpenter
Cc: kernel-janitors, linux-kernel, Philipp Reisner, Jens Axboe,
Lars Ellenberg, drbd-dev
Hi Dan,
Thanks for the work with the static analyzer, but the patch is
bogus. The lc_element_by_index() function causes a BUG_ON before
returning a NULL. The next mail contains a patch that removes
the unnecessary conditional expression operator.
Philipp Reisner (1):
drbd: lc_element_by_index() never returns NULL
drivers/block/drbd/drbd_actlog.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
^ permalink raw reply [flat|nested] 10+ messages in thread
* [Drbd-dev] [PATCH] drbd: lc_element_by_index() never returns NULL
2010-04-01 8:56 ` [Drbd-dev] " Philipp Reisner
@ 2010-04-01 8:56 ` Philipp Reisner
-1 siblings, 0 replies; 10+ messages in thread
From: Philipp Reisner @ 2010-04-01 8:56 UTC (permalink / raw)
To: Dan Carpenter
Cc: kernel-janitors, linux-kernel, Philipp Reisner, Jens Axboe,
Lars Ellenberg, drbd-dev
Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
---
drivers/block/drbd/drbd_actlog.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/block/drbd/drbd_actlog.c b/drivers/block/drbd/drbd_actlog.c
index 43e57f3..df01899 100644
--- a/drivers/block/drbd/drbd_actlog.c
+++ b/drivers/block/drbd/drbd_actlog.c
@@ -1336,7 +1336,7 @@ int drbd_rs_del_all(struct drbd_conf *mdev)
/* ok, ->resync is there. */
for (i = 0; i < mdev->resync->nr_elements; i++) {
e = lc_element_by_index(mdev->resync, i);
- bm_ext = e ? lc_entry(e, struct bm_extent, lce) : NULL;
+ bm_ext = lc_entry(e, struct bm_extent, lce);
if (bm_ext->lce.lc_number == LC_FREE)
continue;
if (bm_ext->lce.lc_number == mdev->resync_wenr) {
--
1.6.3.3
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH] drbd: lc_element_by_index() never returns NULL
@ 2010-04-01 8:56 ` Philipp Reisner
0 siblings, 0 replies; 10+ messages in thread
From: Philipp Reisner @ 2010-04-01 8:56 UTC (permalink / raw)
To: Dan Carpenter
Cc: Lars Ellenberg, Jens Axboe, Philipp Reisner, drbd-dev,
linux-kernel, kernel-janitors
Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
---
drivers/block/drbd/drbd_actlog.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/block/drbd/drbd_actlog.c b/drivers/block/drbd/drbd_actlog.c
index 43e57f3..df01899 100644
--- a/drivers/block/drbd/drbd_actlog.c
+++ b/drivers/block/drbd/drbd_actlog.c
@@ -1336,7 +1336,7 @@ int drbd_rs_del_all(struct drbd_conf *mdev)
/* ok, ->resync is there. */
for (i = 0; i < mdev->resync->nr_elements; i++) {
e = lc_element_by_index(mdev->resync, i);
- bm_ext = e ? lc_entry(e, struct bm_extent, lce) : NULL;
+ bm_ext = lc_entry(e, struct bm_extent, lce);
if (bm_ext->lce.lc_number == LC_FREE)
continue;
if (bm_ext->lce.lc_number == mdev->resync_wenr) {
--
1.6.3.3
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [Drbd-dev] [PATCH] drbd: lc_element_by_index() never returns NULL
2010-04-01 8:56 ` Philipp Reisner
@ 2010-04-02 6:40 ` Jens Axboe
-1 siblings, 0 replies; 10+ messages in thread
From: Jens Axboe @ 2010-04-02 6:40 UTC (permalink / raw)
To: Philipp Reisner
Cc: linux-kernel, Lars Ellenberg, kernel-janitors, Dan Carpenter,
drbd-dev
On Thu, Apr 01 2010, Philipp Reisner wrote:
> Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
> Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Applied
--
Jens Axboe
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2010-04-02 6:50 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-03-27 14:59 [patch] drbd: potential null dereference Dan Carpenter
2010-03-27 14:59 ` Dan Carpenter
2010-03-27 14:59 ` [Drbd-dev] " Dan Carpenter
2010-04-01 8:56 ` Philipp Reisner
2010-04-01 8:56 ` Philipp Reisner
2010-04-01 8:56 ` [Drbd-dev] " Philipp Reisner
2010-04-01 8:56 ` [Drbd-dev] [PATCH] drbd: lc_element_by_index() never returns NULL Philipp Reisner
2010-04-01 8:56 ` Philipp Reisner
2010-04-02 6:40 ` [Drbd-dev] " Jens Axboe
2010-04-02 6:40 ` Jens Axboe
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.