xfs_quota: Fix test for wrapped id from GETNEXTQUOTA
diff mbox

Message ID 44762cf0-ec69-4cb0-ee08-d5889f24df4b@redhat.com
State Accepted
Headers show

Commit Message

Eric Sandeen Dec. 21, 2016, 3:13 p.m. UTC
dump_file and report_mount can be called with null *oid if
we aren't asking for the GETNEXTQUOTA interface, so we
should only test for the GETNEXTQUOTA wrap if *oid is
non-null.  Otherwise we'll deref a null pointer in the
test.

This only happens for certain invocations of reporting,
which apparently are not covered by any regression tests
at this point, at least on new kernels which contain
GETNEXTQUOTA.

Addresses-Coverity-ID: 1397415
Addresses-Coverity-ID: 1397416
Brown-paper-bag-worn-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---


--
To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Bill O'Donnell Dec. 21, 2016, 4:09 p.m. UTC | #1
On Wed, Dec 21, 2016 at 09:13:08AM -0600, Eric Sandeen wrote:
> dump_file and report_mount can be called with null *oid if
> we aren't asking for the GETNEXTQUOTA interface, so we
> should only test for the GETNEXTQUOTA wrap if *oid is
> non-null.  Otherwise we'll deref a null pointer in the
> test.
> 
> This only happens for certain invocations of reporting,
> which apparently are not covered by any regression tests
> at this point, at least on new kernels which contain
> GETNEXTQUOTA.
> 
> Addresses-Coverity-ID: 1397415
> Addresses-Coverity-ID: 1397416
> Brown-paper-bag-worn-by: Eric Sandeen <sandeen@redhat.com>
> Signed-off-by: Eric Sandeen <sandeen@redhat.com>

Looks good.
Reviewed-by: Bill O'Donnell <billodo@redhat.com>

> ---
> 
> diff --git a/quota/report.c b/quota/report.c
> index fc02302..3833dd6 100644
> --- a/quota/report.c
> +++ b/quota/report.c
> @@ -98,12 +98,12 @@ dump_file(
>  		return 0;
>  	}
>  
> -	if (oid)
> +	if (oid) {
>  		*oid = d.d_id;
> -
> -	/* Did kernelspace wrap? */
> -	if (*oid < id)
> -		return 0;
> +		/* Did kernelspace wrap? */
> +		if (*oid < id)
> +			return 0;
> +	}
>  
>  	if (!d.d_blk_softlimit && !d.d_blk_hardlimit &&
>  	    !d.d_ino_softlimit && !d.d_ino_hardlimit &&
> @@ -361,12 +361,12 @@ report_mount(
>  		return 0;
>  	}
>  
> -	if (oid)
> +	if (oid) {
>  		*oid = d.d_id;
> -
> -	/* Did kernelspace wrap? */
> -	if (*oid < id)
> -		return 0;
> +		/* Did kernelspace wrap? */
> +		if (* oid < id)
> +			return 0;
> +	}
>  
>  	if (flags & TERSE_FLAG) {
>  		count = 0;
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Carlos Maiolino Dec. 22, 2016, 9:22 a.m. UTC | #2
On Wed, Dec 21, 2016 at 09:13:08AM -0600, Eric Sandeen wrote:
> dump_file and report_mount can be called with null *oid if
> we aren't asking for the GETNEXTQUOTA interface, so we
> should only test for the GETNEXTQUOTA wrap if *oid is
> non-null.  Otherwise we'll deref a null pointer in the
> test.
> 
> This only happens for certain invocations of reporting,
> which apparently are not covered by any regression tests
> at this point, at least on new kernels which contain
> GETNEXTQUOTA.


Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>

> 
> Addresses-Coverity-ID: 1397415
> Addresses-Coverity-ID: 1397416
> Brown-paper-bag-worn-by: Eric Sandeen <sandeen@redhat.com>
> Signed-off-by: Eric Sandeen <sandeen@redhat.com>
> ---
> 
> diff --git a/quota/report.c b/quota/report.c
> index fc02302..3833dd6 100644
> --- a/quota/report.c
> +++ b/quota/report.c
> @@ -98,12 +98,12 @@ dump_file(
>  		return 0;
>  	}
>  
> -	if (oid)
> +	if (oid) {
>  		*oid = d.d_id;
> -
> -	/* Did kernelspace wrap? */
> -	if (*oid < id)
> -		return 0;
> +		/* Did kernelspace wrap? */
> +		if (*oid < id)
> +			return 0;
> +	}
>  
>  	if (!d.d_blk_softlimit && !d.d_blk_hardlimit &&
>  	    !d.d_ino_softlimit && !d.d_ino_hardlimit &&
> @@ -361,12 +361,12 @@ report_mount(
>  		return 0;
>  	}
>  
> -	if (oid)
> +	if (oid) {
>  		*oid = d.d_id;
> -
> -	/* Did kernelspace wrap? */
> -	if (*oid < id)
> -		return 0;
> +		/* Did kernelspace wrap? */
> +		if (* oid < id)
> +			return 0;
> +	}
>  
>  	if (flags & TERSE_FLAG) {
>  		count = 0;
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch
diff mbox

diff --git a/quota/report.c b/quota/report.c
index fc02302..3833dd6 100644
--- a/quota/report.c
+++ b/quota/report.c
@@ -98,12 +98,12 @@  dump_file(
 		return 0;
 	}
 
-	if (oid)
+	if (oid) {
 		*oid = d.d_id;
-
-	/* Did kernelspace wrap? */
-	if (*oid < id)
-		return 0;
+		/* Did kernelspace wrap? */
+		if (*oid < id)
+			return 0;
+	}
 
 	if (!d.d_blk_softlimit && !d.d_blk_hardlimit &&
 	    !d.d_ino_softlimit && !d.d_ino_hardlimit &&
@@ -361,12 +361,12 @@  report_mount(
 		return 0;
 	}
 
-	if (oid)
+	if (oid) {
 		*oid = d.d_id;
-
-	/* Did kernelspace wrap? */
-	if (*oid < id)
-		return 0;
+		/* Did kernelspace wrap? */
+		if (* oid < id)
+			return 0;
+	}
 
 	if (flags & TERSE_FLAG) {
 		count = 0;