Re: coverity-sunrpc-xprt-task-null-check.patch added to -mm tree

Re: coverity-sunrpc-xprt-task-null-check.patch added to -mm tree

[Alexey Dobriyan]

On Friday 01 July 2005 10:15, akpm@osdl.org wrote:
> --- devel/net/sunrpc/xprt.c~coverity-sunrpc-xprt-task-null-check
> +++ devel-akpm/net/sunrpc/xprt.c
> @@ -140,7 +140,10 @@ xprt_from_sock(struct sock *sk)
>  static int
>  __xprt_lock_write(struct rpc_xprt *xprt, struct rpc_task *task)
>  {
> -	struct rpc_rqst *req = task->tk_rqstp;
> +        struct rpc_rqst *req = NULL;
> +
> +	if (task)
> +                req = task->tk_rqstp;

2 callers of __xprt_lock_write():
----------------------------------------------------------------------------
static inline int xprt_lock_write(struct rpc_xprt *xprt, struct rpc_task *task)
{
        int retval;

        spin_lock_bh(&xprt->sock_lock);
===>    retval = __xprt_lock_write(xprt, task);	<===
        spin_unlock_bh(&xprt->sock_lock);
        return retval;
}
----+-----------------------------------------------------------------------
    |1 caller for xprt_lock_write():
    |
    |void xprt_connect(struct rpc_task *task)
    |{
    |===>    struct rpc_xprt *xprt = task->tk_xprt;	<===
    |
    |        dprintk("RPC: %4d xprt_connect xprt %p %s connected\n", task->tk_pid,
    |                        xprt, (xprt_connected(xprt) ? "is" : "is not"));
    |
    |        if (xprt->shutdown) {
    |                task->tk_status = -EIO;
    |                return;
    |        }
    |        if (!xprt->addr.sin_port) {
    |                task->tk_status = -EIO;
    |                return;
    |        }
    |        if (!xprt_lock_write(xprt, task))
    |
    |task was already dereferenced.
----+-----------------------------------------------------------------------
int xprt_prepare_transmit(struct rpc_task *task)
{
===>    struct rpc_rqst *req = task->tk_rqstp;	<===
        struct rpc_xprt *xprt = req->rq_xprt;
        int err = 0;

        dprintk("RPC: %4d xprt_prepare_transmit\n", task->tk_pid);

        if (xprt->shutdown)
                return -EIO;

        spin_lock_bh(&xprt->sock_lock);
        if (req->rq_received && !req->rq_bytes_sent) {
                err = req->rq_received;
                goto out_unlock;
        }
        if (!__xprt_lock_write(xprt, task)) {

task was already dereferenced.
----------------------------------------------------------------------------