re: ipc: cleanup do_msgrcv() aroung MSG_COPY feature

re: ipc: cleanup do_msgrcv() aroung MSG_COPY feature

[Dan Carpenter]

Hello Stanislav Kinsbursky,

This is a semi-automatic email about new static checker warnings.

The patch 6645154dd758: "ipc: cleanup do_msgrcv() aroung MSG_COPY 
feature" from Nov 3, 2012, leads to the following Smatch complaint:

ipc/msg.c:878 do_msgrcv()
	 error: we previously assumed 'msg' could be null (see line 865)

ipc/msg.c
   861                                  } else if (msgflg & MSG_COPY) {
   862                                          msg = fill_copy(copy_number,
   863                                                          msg_counter,
   864                                                          walk_msg, copy);
   865						if (msg)
                                                   ^^^^
New check.  fill_copy() either returns an error pointer, a valid pointer
or NULL.

   866							break;
   867					} else
   868						break;
   869					msg_counter++;
   870				}
   871				tmp = tmp->next;
   872			}
   873			if (!IS_ERR(msg)) {
   874				/*
   875				 * Found a suitable message.
   876				 * Unlink it from the queue.
   877				 */
   878				if ((bufsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) {
                                             ^^^^^
Old dereference.

   879					msg = ERR_PTR(-E2BIG);
   880					goto out_unlock;

regards,
dan carpenter