Linux-Next Archive on lore.kernel.org
 help / color / Atom feed
* Coverity: rds_send_remove_from_sock(): Null pointer dereferences
@ 2021-04-08 23:40 coverity-bot
  0 siblings, 0 replies; only message in thread
From: coverity-bot @ 2021-04-08 23:40 UTC (permalink / raw)
  To: Aditya Pakki
  Cc: Santosh Shilimkar, David S. Miller, Gustavo A. R. Silva, linux-next

Hello!

This is an experimental semi-automated report about issues detected by
Coverity from a scan of next-20210408 as part of the linux-next scan project:
https://scan.coverity.com/projects/linux-next-weekly-scan

You're getting this email because you were associated with the identified
lines of code (noted below) that were touched by commits:

  Wed Apr 7 14:01:24 2021 -0700
    0c85a7e87465 ("net/rds: Avoid potential use after free in rds_send_remove_from_sock")

Coverity reported the following:

*** CID 1503716:  Null pointer dereferences  (REVERSE_INULL)
/net/rds/send.c: 668 in rds_send_remove_from_sock()
662     		}
663     		spin_unlock(&rs->rs_lock);
664
665     unlock_and_drop:
666     		spin_unlock_irqrestore(&rm->m_rs_lock, flags);
667     		rds_message_put(rm);
vvv     CID 1503716:  Null pointer dereferences  (REVERSE_INULL)
vvv     Null-checking "rm" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
668     		if (was_on_sock && rm)
669     			rds_message_put(rm);
670     	}
671
672     	if (rs) {
673     		rds_wake_sk_sleep(rs);

If this is a false positive, please let us know so we can mark it as
such, or teach the Coverity rules to be smarter. If not, please make
sure fixes get into linux-next. :) For patches fixing this, please
include these lines (but double-check the "Fixes" first):

Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1503716 ("Null pointer dereferences")
Fixes: 0c85a7e87465 ("net/rds: Avoid potential use after free in rds_send_remove_from_sock")

Thanks for your attention!

-- 
Coverity-bot

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-08 23:40 Coverity: rds_send_remove_from_sock(): Null pointer dereferences coverity-bot

Linux-Next Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-next/0 linux-next/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-next linux-next/ https://lore.kernel.org/linux-next \
		linux-next@vger.kernel.org
	public-inbox-index linux-next

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-next


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git