[LU-10504] Null pointer 'layout' that comes from line 1153 may be dereferenced at line 1179 in mirror_create()

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.11.0
• Labels: kw
• Severity: 3
• Assignee: Jian Yu
• Reporter: Dmitry Eremin (Inactive)

Description

static int mirror_create(char *fname, struct mirror_args *mirror_list)
{
1153		struct llapi_layout *layout = NULL;
1154		struct mirror_args *cur_mirror = NULL;
1155		uint16_t mirror_count = 0;
1156		int i = 0;
1157		int rc = 0;
1158	 
1159		rc = mirror_create_sanity_check(NULL, mirror_list);
1160		if (rc)
1161			return rc;
1162	 
1163		cur_mirror = mirror_list;
1164		while (cur_mirror != NULL) {
1165			for (i = 0; i < cur_mirror->m_count; i++) {...}
1175			mirror_count += cur_mirror->m_count;
1176			cur_mirror = cur_mirror->m_next;
1177		}
1178	 
1179		rc = llapi_layout_mirror_count_set(layout, mirror_count);
1180		if (rc) {...}

TRACEBACK

An event which alters the program's state, leading to the defect
lfs.c:1153: 'layout' has been assigned a NULL value.

A condition which occurs, leading to the defect
lfs.c:1165: Not entering loop, because i<cur_mirror->m_count is false

An event which alters the program's state, leading to the defect
lfs.c:1179: 'layout' is dereferenced by passing argument 1 to function 'llapi_layout_mirror_count_set'.

An event which alters the program's state, leading to the defect
liblustreapi_layout.c:1585: 'layout' is passed to function 'llapi_layout_mirror_count_set'.

An event which alters the program's state, leading to the defect
liblustreapi_layout.c:1588: 'layout' is explicitly dereferenced.