re: ipc: cleanup do_msgrcv() aroung MSG_COPY feature

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello Stanislav Kinsbursky,

This is a semi-automatic email about new static checker warnings.

The patch 6645154dd758: "ipc: cleanup do_msgrcv() aroung MSG_COPY 
feature" from Nov 3, 2012, leads to the following Smatch complaint:

ipc/msg.c:878 do_msgrcv()
	 error: we previously assumed 'msg' could be null (see line 865)

ipc/msg.c
   861                                  } else if (msgflg & MSG_COPY) {
   862                                          msg = fill_copy(copy_number,
   863                                                          msg_counter,
   864                                                          walk_msg, copy);
   865						if (msg)
                                                   ^^^^
New check.  fill_copy() either returns an error pointer, a valid pointer
or NULL.

   866							break;
   867					} else
   868						break;
   869					msg_counter++;
   870				}
   871				tmp = tmp->next;
   872			}
   873			if (!IS_ERR(msg)) {
   874				/*
   875				 * Found a suitable message.
   876				 * Unlink it from the queue.
   877				 */
   878				if ((bufsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) {
                                             ^^^^^
Old dereference.

   879					msg = ERR_PTR(-E2BIG);
   880					goto out_unlock;

regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Kernel Development]     [Kernel Announce]     [Kernel Newbies]     [Linux Networking Development]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Device Mapper]

  Powered by Linux