netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* Fw: New Defects reported by Coverity Scan for Linux
@ 2015-11-03 16:18 Stephen Hemminger
  2015-11-03 19:32 ` Jon Maloy
  2015-11-04  1:45 ` Fw: " Ying Xue
  0 siblings, 2 replies; 6+ messages in thread
From: Stephen Hemminger @ 2015-11-03 16:18 UTC (permalink / raw)
  To: Jon Maloy, Ying Xue; +Cc: netdev

The TIPC case is a missing check for memory allocation failure.


Begin forwarded message:

Date: Mon, 02 Nov 2015 23:45:55 -0800
From: scan-admin@coverity.com
To: stephen@networkplumber.org
Subject: New Defects reported by Coverity Scan for Linux



Hi,

Please find the latest report on new defect(s) introduced to Linux found with Coverity Scan.

4 new defect(s) introduced to Linux found with Coverity Scan.
9 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 4 of 4 defect(s)


** CID 1338065:  Error handling issues  (CHECKED_RETURN)
/net/tipc/udp_media.c: 162 in tipc_udp_send_msg()


________________________________________________________________________________________________________
*** CID 1338065:  Error handling issues  (CHECKED_RETURN)
/net/tipc/udp_media.c: 162 in tipc_udp_send_msg()
156     	struct udp_media_addr *dst = (struct udp_media_addr *)&dest->value;
157     	struct udp_media_addr *src = (struct udp_media_addr *)&b->addr.value;
158     	struct sk_buff *clone;
159     	struct rtable *rt;
160     
161     	if (skb_headroom(skb) < UDP_MIN_HEADROOM)
>>>     CID 1338065:  Error handling issues  (CHECKED_RETURN)
>>>     Calling "pskb_expand_head" without checking return value (as is done elsewhere 51 out of 56 times).
162     		pskb_expand_head(skb, UDP_MIN_HEADROOM, 0, GFP_ATOMIC);
163     
164     	clone = skb_clone(skb, GFP_ATOMIC);
165     	skb_set_inner_protocol(clone, htons(ETH_P_TIPC));
166     	ub = rcu_dereference_rtnl(b->media_ptr);
167     	if (!ub) {

** CID 1338066:  Null pointer dereferences  (FORWARD_NULL)
/net/openvswitch/flow_netlink.c: 1379 in __ovs_nla_put_key()


________________________________________________________________________________________________________
*** CID 1338066:  Null pointer dereferences  (FORWARD_NULL)
/net/openvswitch/flow_netlink.c: 1379 in __ovs_nla_put_key()
1373     		goto nla_put_failure;
1374     
1375     	if (nla_put_u32(skb, OVS_KEY_ATTR_PRIORITY, output->phy.priority))
1376     		goto nla_put_failure;
1377     
1378     	if ((swkey->tun_key.u.ipv4.dst || is_mask)) {
>>>     CID 1338066:  Null pointer dereferences  (FORWARD_NULL)
>>>     Assigning: "opts" = "NULL".
1379     		const void *opts = NULL;
1380     
1381     		if (output->tun_key.tun_flags & TUNNEL_OPTIONS_PRESENT)
1382     			opts = TUN_METADATA_OPTS(output, swkey->tun_opts_len);
1383     
1384     		if (ipv4_tun_to_nlattr(skb, &output->tun_key, opts,

** CID 1338067:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
/drivers/net/ethernet/cavium/thunder/nic_main.c: 407 in nic_config_cpi()


________________________________________________________________________________________________________
*** CID 1338067:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
/drivers/net/ethernet/cavium/thunder/nic_main.c: 407 in nic_config_cpi()
401     			nic_reg_write(nic, NIC_PF_CPI_0_2047_CFG | (cpi << 3),
402     				      (vnic << 24) | (padd << 16) |
403     				      (rssi_base + rssi));
404     		} else {
405     			/* Set MPI_ALG to '0' to disable MCAM parsing */
406     			nic_reg_write(nic, NIC_PF_CPI_0_2047_CFG | (cpi << 3),
>>>     CID 1338067:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
>>>     Potentially overflowing expression "padd << 16" with type "u32" (32 bits, unsigned) is evaluated using 32-bit arithmetic, and then used in a context that expects an expression of type "u64" (64 bits, unsigned).
407     				      (padd << 16));
408     			/* MPI index is same as CPI if MPI_ALG is not enabled */
409     			nic_reg_write(nic, NIC_PF_MPI_0_2047_CFG | (cpi << 3),
410     				      (vnic << 24) | (rssi_base + rssi));
411     		}
412     

** CID 1338068:  Null pointer dereferences  (REVERSE_INULL)
/include/net/dst_metadata.h: 69 in tun_dst_unclone()


________________________________________________________________________________________________________
*** CID 1338068:  Null pointer dereferences  (REVERSE_INULL)
/include/net/dst_metadata.h: 69 in tun_dst_unclone()
63     static inline struct metadata_dst *tun_dst_unclone(struct sk_buff *skb)
64     {
65     	struct metadata_dst *md_dst = skb_metadata_dst(skb);
66     	int md_size = md_dst->u.tun_info.options_len;
67     	struct metadata_dst *new_md;
68     
>>>     CID 1338068:  Null pointer dereferences  (REVERSE_INULL)
>>>     Null-checking "md_dst" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
69     	if (!md_dst)
70     		return ERR_PTR(-EINVAL);
71     
72     	new_md = metadata_dst_alloc(md_size, GFP_ATOMIC);
73     	if (!new_md)
74     		return ERR_PTR(-ENOMEM);


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, https://scan.coverity.com/projects/linux?tab=overview

To manage Coverity Scan email notifications for "stephen@networkplumber.org", click https://scan.coverity.com/subscriptions/edit?email=stephen%40networkplumber.org&token=41b352b884ef3fc73426635eebc294c3

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Fw: New Defects reported by Coverity Scan for Linux
@ 2017-04-24 23:41 Stephen Hemminger
  2017-04-25  0:09 ` Cong Wang
  0 siblings, 1 reply; 6+ messages in thread
From: Stephen Hemminger @ 2017-04-24 23:41 UTC (permalink / raw)
  To: Jamal Hadi Salim, Cong Wang, Jiri Pirko; +Cc: netdev

This looks like a false positive

Date: Mon, 24 Apr 2017 14:40:46 -0700
From: scan-admin@coverity.com
To: stephen@networkplumber.org
Subject: New Defects reported by Coverity Scan for Linux


1 new defect(s) introduced to Linux found with Coverity Scan.
2 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 1 of 1 defect(s)


** CID 1405487:  Resource leaks  (RESOURCE_LEAK)
/net/sched/act_api.c: 635 in tcf_action_init_1()


________________________________________________________________________________________________________
*** CID 1405487:  Resource leaks  (RESOURCE_LEAK)
/net/sched/act_api.c: 635 in tcf_action_init_1()
629     	 * if it exists and is only bound to in a_o->init() then
630     	 * ACT_P_CREATED is not returned (a zero is).
631     	 */
632     	if (err != ACT_P_CREATED)
633     		module_put(a_o->owner);
634     
>>>     CID 1405487:  Resource leaks  (RESOURCE_LEAK)
>>>     Variable "cookie" going out of scope leaks the storage it points to.  
635     	return a;
636     
637     err_mod:
638     	module_put(a_o->owner);
639     err_out:
640     	if (cookie) {

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2017-04-25  0:23 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-11-03 16:18 Fw: New Defects reported by Coverity Scan for Linux Stephen Hemminger
2015-11-03 19:32 ` Jon Maloy
2015-11-04  1:45 ` Fw: " Ying Xue
  -- strict thread matches above, loose matches on Subject: below --
2017-04-24 23:41 Stephen Hemminger
2017-04-25  0:09 ` Cong Wang
2017-04-25  0:23   ` Jamal Hadi Salim

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).