diff mbox series

[2/2] nfs-utils: Removed a number of Coverity Scan USE_AFTER_FREE errors

Message ID 20190826143421.13712-2-steved@redhat.com (mailing list archive)
State New, archived
Headers show
Series [1/2] nfs-utils: Removed a number of Coverity Scan RESOURCE_LEAK errors | expand

Commit Message

Steve Dickson Aug. 26, 2019, 2:34 p.m. UTC 
Signed-off-by: Steve Dickson <steved@redhat.com>
---
 utils/gssd/krb5_util.c | 4 +++-
 utils/idmapd/idmapd.c  | 6 ++++--
 utils/statd/monitor.c  | 5 ++++-
 utils/statd/notlist.c  | 9 +++++++--
 4 files changed, 18 insertions(+), 6 deletions(-)

Comments

Steve Dickson Aug. 26, 2019, 5:53 p.m. UTC | #1 
On 8/26/19 10:34 AM, Steve Dickson wrote:
> Signed-off-by: Steve Dickson <steved@redhat.com>
> ---
>  utils/gssd/krb5_util.c | 4 +++-
>  utils/idmapd/idmapd.c  | 6 ++++--
>  utils/statd/monitor.c  | 5 ++++-
>  utils/statd/notlist.c  | 9 +++++++--
>  4 files changed, 18 insertions(+), 6 deletions(-)
Committed... 

steved.
> 
> diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c
> index f68be85..0474783 100644
> --- a/utils/gssd/krb5_util.c
> +++ b/utils/gssd/krb5_util.c
> @@ -1016,6 +1016,8 @@ query_krb5_ccache(const char* cred_cache, char **ret_princname,
>  	char *str = NULL;
>  	char *princstring;
>  
> +	*ret_princname = *ret_realm = NULL;
> +
>  	ret = krb5_init_context(&context);
>  	if (ret) 
>  		return 0;
> @@ -1050,7 +1052,7 @@ err_princ:
>  	krb5_cc_close(context, ccache);
>  err_cache:
>  	krb5_free_context(context);
> -	return found;
> +	return (*ret_princname && *ret_realm);
>  }
>  
>  /*==========================*/
> diff --git a/utils/idmapd/idmapd.c b/utils/idmapd/idmapd.c
> index 267acea..c187e7d 100644
> --- a/utils/idmapd/idmapd.c
> +++ b/utils/idmapd/idmapd.c
> @@ -520,14 +520,16 @@ static void
>  clntscancb(int UNUSED(fd), short UNUSED(which), void *data)
>  {
>  	struct idmap_clientq *icq = data;
> -	struct idmap_client *ic;
> +	struct idmap_client *ic, *ic_next;
>  
> -	TAILQ_FOREACH(ic, icq, ic_next)
> +	for (ic = TAILQ_FIRST(icq); ic != NULL; ic = ic_next) { 
> +		ic_next = TAILQ_NEXT(ic, ic_next);
>  		if (ic->ic_fd == -1 && nfsopen(ic) == -1) {
>  			close(ic->ic_dirfd);
>  			TAILQ_REMOVE(icq, ic, ic_next);
>  			free(ic);
>  		}
> +	}
>  }
>  
>  static void
> diff --git a/utils/statd/monitor.c b/utils/statd/monitor.c
> index 9400048..20c8ebd 100644
> --- a/utils/statd/monitor.c
> +++ b/utils/statd/monitor.c
> @@ -66,7 +66,7 @@ sm_mon_1_svc(struct mon *argp, struct svc_req *rqstp)
>  			*my_name  = argp->mon_id.my_id.my_name;
>  	struct my_id	*id = &argp->mon_id.my_id;
>  	char		*cp;
> -	notify_list	*clnt;
> +	notify_list	*clnt = NULL;
>  	struct sockaddr_in my_addr = {
>  		.sin_family		= AF_INET,
>  		.sin_addr.s_addr	= htonl(INADDR_LOOPBACK),
> @@ -177,6 +177,7 @@ sm_mon_1_svc(struct mon *argp, struct svc_req *rqstp)
>  	 * We're committed...ignoring errors.  Let's hope that a malloc()
>  	 * doesn't fail.  (I should probably fix this assumption.)
>  	 */
> +	clnt = NULL;
>  	if (!existing && !(clnt = nlist_new(my_name, mon_name, 0))) {
>  		free(dnsname);
>  		xlog_warn("out of memory");
> @@ -223,6 +224,7 @@ sm_mon_1_svc(struct mon *argp, struct svc_req *rqstp)
>  
>  failure:
>  	xlog_warn("STAT_FAIL to %s for SM_MON of %s", my_name, mon_name);
> +	free(clnt);
>  	return (&result);
>  }
>  
> @@ -242,6 +244,7 @@ load_one_host(const char *hostname,
>  	clnt->dns_name = strdup(hostname);
>  	if (clnt->dns_name == NULL) {
>  		nlist_free(NULL, clnt);
> +		free(clnt);
>  		return 0;
>  	}
>  
> diff --git a/utils/statd/notlist.c b/utils/statd/notlist.c
> index 0341c15..45879a4 100644
> --- a/utils/statd/notlist.c
> +++ b/utils/statd/notlist.c
> @@ -210,7 +210,6 @@ nlist_free(notify_list **head, notify_list *entry)
>  	if (NL_MON_NAME(entry))
>  		free(NL_MON_NAME(entry));
>  	free(entry->dns_name);
> -	free(entry);
>  }
>  
>  /* 
> @@ -219,8 +218,14 @@ nlist_free(notify_list **head, notify_list *entry)
>  void 
>  nlist_kill(notify_list **head)
>  {
> -	while (*head)
> +	notify_list *next;
> +
> +	while (*head) {
> +		next = (*head)->next;
>  		nlist_free(head, *head);
> +		free(*head);
> +		*head = next;
> +	}
>  }
>  
>  /*
>
diff mbox series

Patch

diff --git a/utils/gssd/krb5_util.c b/utils/gssd/krb5_util.c
index f68be85..0474783 100644
--- a/utils/gssd/krb5_util.c
+++ b/utils/gssd/krb5_util.c
@@ -1016,6 +1016,8 @@  query_krb5_ccache(const char* cred_cache, char **ret_princname,
 	char *str = NULL;
 	char *princstring;
 
+	*ret_princname = *ret_realm = NULL;
+
 	ret = krb5_init_context(&context);
 	if (ret) 
 		return 0;
@@ -1050,7 +1052,7 @@  err_princ:
 	krb5_cc_close(context, ccache);
 err_cache:
 	krb5_free_context(context);
-	return found;
+	return (*ret_princname && *ret_realm);
 }
 
 /*==========================*/
diff --git a/utils/idmapd/idmapd.c b/utils/idmapd/idmapd.c
index 267acea..c187e7d 100644
--- a/utils/idmapd/idmapd.c
+++ b/utils/idmapd/idmapd.c
@@ -520,14 +520,16 @@  static void
 clntscancb(int UNUSED(fd), short UNUSED(which), void *data)
 {
 	struct idmap_clientq *icq = data;
-	struct idmap_client *ic;
+	struct idmap_client *ic, *ic_next;
 
-	TAILQ_FOREACH(ic, icq, ic_next)
+	for (ic = TAILQ_FIRST(icq); ic != NULL; ic = ic_next) { 
+		ic_next = TAILQ_NEXT(ic, ic_next);
 		if (ic->ic_fd == -1 && nfsopen(ic) == -1) {
 			close(ic->ic_dirfd);
 			TAILQ_REMOVE(icq, ic, ic_next);
 			free(ic);
 		}
+	}
 }
 
 static void
diff --git a/utils/statd/monitor.c b/utils/statd/monitor.c
index 9400048..20c8ebd 100644
--- a/utils/statd/monitor.c
+++ b/utils/statd/monitor.c
@@ -66,7 +66,7 @@  sm_mon_1_svc(struct mon *argp, struct svc_req *rqstp)
 			*my_name  = argp->mon_id.my_id.my_name;
 	struct my_id	*id = &argp->mon_id.my_id;
 	char		*cp;
-	notify_list	*clnt;
+	notify_list	*clnt = NULL;
 	struct sockaddr_in my_addr = {
 		.sin_family		= AF_INET,
 		.sin_addr.s_addr	= htonl(INADDR_LOOPBACK),
@@ -177,6 +177,7 @@  sm_mon_1_svc(struct mon *argp, struct svc_req *rqstp)
 	 * We're committed...ignoring errors.  Let's hope that a malloc()
 	 * doesn't fail.  (I should probably fix this assumption.)
 	 */
+	clnt = NULL;
 	if (!existing && !(clnt = nlist_new(my_name, mon_name, 0))) {
 		free(dnsname);
 		xlog_warn("out of memory");
@@ -223,6 +224,7 @@  sm_mon_1_svc(struct mon *argp, struct svc_req *rqstp)
 
 failure:
 	xlog_warn("STAT_FAIL to %s for SM_MON of %s", my_name, mon_name);
+	free(clnt);
 	return (&result);
 }
 
@@ -242,6 +244,7 @@  load_one_host(const char *hostname,
 	clnt->dns_name = strdup(hostname);
 	if (clnt->dns_name == NULL) {
 		nlist_free(NULL, clnt);
+		free(clnt);
 		return 0;
 	}
 
diff --git a/utils/statd/notlist.c b/utils/statd/notlist.c
index 0341c15..45879a4 100644
--- a/utils/statd/notlist.c
+++ b/utils/statd/notlist.c
@@ -210,7 +210,6 @@  nlist_free(notify_list **head, notify_list *entry)
 	if (NL_MON_NAME(entry))
 		free(NL_MON_NAME(entry));
 	free(entry->dns_name);
-	free(entry);
 }
 
 /* 
@@ -219,8 +218,14 @@  nlist_free(notify_list **head, notify_list *entry)
 void 
 nlist_kill(notify_list **head)
 {
-	while (*head)
+	notify_list *next;
+
+	while (*head) {
+		next = (*head)->next;
 		nlist_free(head, *head);
+		free(*head);
+		*head = next;
+	}
 }
 
 /*