* re: libnvdimm: remove else after return in nsio_rw_bytes()
@ 2016-12-16 13:45 Colin Ian King
0 siblings, 0 replies; only message in thread
From: Colin Ian King @ 2016-12-16 13:45 UTC (permalink / raw)
To: Fabian Frederick, Dan Williams, linux-nvdimm
Hi there,
While performing some bi-weekly static analysis on linux-next I
discovered a potential -ve sized memcpy in drivers/nvdimm/claim.c in
nsio_rw_bytes() which probably some attention.
CoverityScan found this issue, I think it stems from commit
d37806dc37b42b05515849b0444f09f493cb4cba ("libnvdimm: remove else after
return in nsio_rw_bytes()").
This issue occurs when nvdimm_clear_poison can return a -ve error such
as -ENXIO as follows:
cleared = nvdimm_clear_poison(&ndns->dev, offset, size);
if (cleared != size) {
size = cleared;
rc = -EIO;
}
a little later a memcpy_to_pmem() occurs using the -ve size:
memcpy_to_pmem(nsio->addr + offset, buf, size);
..which doesn't look sane to me. I'm not sure what the default behavior
should be for this kind of error handling, so I'm drawing this issue to
your attention.
Colin
_______________________________________________
Linux-nvdimm mailing list
Linux-nvdimm@lists.01.org
https://lists.01.org/mailman/listinfo/linux-nvdimm
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2016-12-16 13:45 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-12-16 13:45 libnvdimm: remove else after return in nsio_rw_bytes() Colin Ian King
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.