| Message ID | 1535739372-24454-4-git-send-email-Liam.Merwick@oracle.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | off-by-one and NULL pointer accesses detected by static analysis | expand |
Hi, On 31.08.18 20:16, Liam Merwick wrote: > The dev_id returned by the call to blk_get_attached_dev_id() in > blk_root_get_parent_desc() can be NULL (an internal call to > object_get_canonical_path may have returned NULL) so it should > be checked before dereferencing. > > Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com> > Reviewed-by: Darren Kenny <Darren.Kenny@oracle.com> > Reviewed-by: Mark Kanda <Mark.Kanda@oracle.com> > --- > block/block-backend.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/block/block-backend.c b/block/block-backend.c > index fa120630be83..210eee75006a 100644 > --- a/block/block-backend.c > +++ b/block/block-backend.c > @@ -136,7 +136,7 @@ static char *blk_root_get_parent_desc(BdrvChild *child) > } > > dev_id = blk_get_attached_dev_id(blk); > - if (*dev_id) { > + if (dev_id && *dev_id) { > return dev_id; I rather think that blk_get_attached_dev_id() needs attention first. It returns an explicitly empty string if blk->dev is NULL. If NULL was a valid return value, it should just return NULL there. Besides this caller, there are two callers that pass the dev_id to qapi_event_send_device_tray_moved(). Now in practice that allows the string to be NULL, but there is a comment in visit_type_str() that says one should not pass NULL. So it's either changing blk_get_attached_dev_id() to return NULL when there is no valid ID (instead of the empty string, and then we could save ourselves the check "*dev_id" here and elsewhere), but then we have to fix all callers. Or we make it return an empty string if object_get_canonical_path() returned NULL. Max > } else { > /* TODO Callback into the BB owner for something more detailed */ >
On 12/10/18 15:48, Max Reitz wrote: > Hi, > > On 31.08.18 20:16, Liam Merwick wrote: >> The dev_id returned by the call to blk_get_attached_dev_id() in >> blk_root_get_parent_desc() can be NULL (an internal call to >> object_get_canonical_path may have returned NULL) so it should >> be checked before dereferencing. >> >> Signed-off-by: Liam Merwick <Liam.Merwick@oracle.com> >> Reviewed-by: Darren Kenny <Darren.Kenny@oracle.com> >> Reviewed-by: Mark Kanda <Mark.Kanda@oracle.com> >> --- >> block/block-backend.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/block/block-backend.c b/block/block-backend.c >> index fa120630be83..210eee75006a 100644 >> --- a/block/block-backend.c >> +++ b/block/block-backend.c >> @@ -136,7 +136,7 @@ static char *blk_root_get_parent_desc(BdrvChild *child) >> } >> >> dev_id = blk_get_attached_dev_id(blk); >> - if (*dev_id) { >> + if (dev_id && *dev_id) { >> return dev_id; > > I rather think that blk_get_attached_dev_id() needs attention first. It > returns an explicitly empty string if blk->dev is NULL. If NULL was a > valid return value, it should just return NULL there. > > Besides this caller, there are two callers that pass the dev_id to > qapi_event_send_device_tray_moved(). Now in practice that allows the > string to be NULL, but there is a comment in visit_type_str() that says > one should not pass NULL. > > So it's either changing blk_get_attached_dev_id() to return NULL when > there is no valid ID (instead of the empty string, and then we could > save ourselves the check "*dev_id" here and elsewhere), but then we have > to fix all callers. > > Or we make it return an empty string if object_get_canonical_path() > returned NULL. > I went with the latter and now (in upcoming v4) check the return value from object_get_canonical_path() and return an empty string if it's NULL. Regards, Liam > Max > >> } else { >> /* TODO Callback into the BB owner for something more detailed */ >> > >
diff --git a/block/block-backend.c b/block/block-backend.c index fa120630be83..210eee75006a 100644 --- a/block/block-backend.c +++ b/block/block-backend.c @@ -136,7 +136,7 @@ static char *blk_root_get_parent_desc(BdrvChild *child) } dev_id = blk_get_attached_dev_id(blk); - if (*dev_id) { + if (dev_id && *dev_id) { return dev_id; } else { /* TODO Callback into the BB owner for something more detailed */