Skip to contentSkip to conversation

smatch stuff: potential NULL dereference in btrfs_rm_device()

DISCUSSION Dan Carpenter 2 participants 2 messages Nov 8, 2011 Btrfs file system

lore
Share & tools
lore
#0 lore raw

Hi Yan,

Smatch complains about this code from 2008.

fs/btrfs/volumes.c +1417 btrfs_rm_device(157)
error: we previously assumed 'fs_devices' could be null (see line 1412)

  1412                  while (fs_devices) {
                               ^^^^^^^^^^

checked here.

1413 if (fs_devices->seed == cur_devices)
1414 break;
1415 fs_devices = fs_devices->seed;
1416 }

  1417                  fs_devices->seed = cur_devices->seed;
                        ^^^^^^^^^^^^

dereferenced here.

If we don't hit the break statement, then at the end of the loop we'd oops.

regards,
dan carpenter

#1 lore raw
Quoted 15 lines · Dan Carpenter

Hi Yan,

Smatch complains about this code from 2008.

fs/btrfs/volumes.c +1417 btrfs_rm_device(157)
error: we previously assumed 'fs_devices' could be null (see line 1412)

  1412                  while (fs_devices) {
                               ^^^^^^^^^^

checked here.

1413 if (fs_devices->seed == cur_devices)
1414 break;
1415 fs_devices = fs_devices->seed;
1416 }

Quoted 6 lines
  1417                  fs_devices->seed = cur_devices->seed;
                        ^^^^^^^^^^^^

dereferenced here.

If we don't hit the break statement, then at the end of the loop we'd oops.

I don't think Zheng works for Oracle (and on Btrfs) any more. I'll look into it.

Thanks,

Ilya