From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>
To: "Konrad Rzeszutek Wilk" <konrad.wilk@oracle.com>,
"Roger Pau Monné" <roger.pau@citrix.com>
Cc: xen-devel@lists.xenproject.org, linux-kernel@vger.kernel.org
Subject: [block-xen-blkback] question about pontential null pointer dereference
Date: Wed, 10 May 2017 11:49:53 -0500 [thread overview]
Message-ID: <20170510114953.Horde.7C1VjUQI-YiZdSL2tKfFVHL@gator4166.hostgator.com> (raw)
Hello everybody,
While looking into Coverity ID 1350942 I ran into the following piece
of code at drivers/block/xen-blkback/xenbus.c:490:
490static int xen_blkbk_remove(struct xenbus_device *dev)
491{
492 struct backend_info *be = dev_get_drvdata(&dev->dev);
493
494 pr_debug("%s %p %d\n", __func__, dev, dev->otherend_id);
495
496 if (be->major || be->minor)
497 xenvbd_sysfs_delif(dev);
498
499 if (be->backend_watch.node) {
500 unregister_xenbus_watch(&be->backend_watch);
501 kfree(be->backend_watch.node);
502 be->backend_watch.node = NULL;
503 }
504
505 dev_set_drvdata(&dev->dev, NULL);
506
507 if (be->blkif)
508 xen_blkif_disconnect(be->blkif);
509
510 /* Put the reference we set in xen_blkif_alloc(). */
511 xen_blkif_put(be->blkif);
512 kfree(be->mode);
513 kfree(be);
514 return 0;
515}
The issue here is that line 507 implies that be->blkif might be NULL.
If this is the case, there is a NULL pointer dereference when
executing line 511 once macro xen_blkif_put() dereference be->blkif
Is there any chance for be->blkif to be NULL at line 511?
I'm trying to figure out if this is a false positive or something that
actually needs to be fixed.
I'd really appreciate any comment on this.
Thank you!
--
Gustavo A. R. Silva
next reply other threads:[~2017-05-10 16:49 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-05-10 16:49 Gustavo A. R. Silva [this message]
2017-05-11 8:53 ` [block-xen-blkback] question about pontential null pointer dereference Juergen Gross
2017-05-11 8:53 ` [Xen-devel] " Juergen Gross
2017-05-11 15:05 ` Gustavo A. R. Silva
2017-05-11 15:05 ` Gustavo A. R. Silva
2017-05-11 15:27 ` [PATCH] block: xen-blkback: add null check to avoid " Gustavo A. R. Silva
2017-05-11 15:27 ` Gustavo A. R. Silva
2017-05-15 21:18 ` Konrad Rzeszutek Wilk
2017-05-15 21:18 ` Konrad Rzeszutek Wilk
2017-05-10 16:49 [block-xen-blkback] question about pontential " Gustavo A. R. Silva
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170510114953.Horde.7C1VjUQI-YiZdSL2tKfFVHL@gator4166.hostgator.com \
--to=garsilva@embeddedor.com \
--cc=konrad.wilk@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=roger.pau@citrix.com \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.