[LU-6021] 5 new static analysis issues in lnetconfig

• Type: Bug
• Resolution: Fixed
• Priority: Major
• Fix Version/s: Lustre 2.7.0
• Affects Version/s: Lustre 2.7.0
• Labels: kw
• Severity: 3
• Assignee: Amir Shehata (Inactive)
• Reporter: Dmitry Eremin (Inactive)

Description

Found 5 new static analysis issues in 2.6.91-26-g6b0fa76:

1. Result of function that may return NULL will be dereferenced
   • lnet/utils/cyaml/cyaml.c: in print_value, Pointer 'node' returned from call to function 'cYAML_ll_pop' at line 886 may be NULL and will be dereferenced at line 888.
2. Null pointer may be dereferenced
   • lnet/utils/lnetconfig/liblnetconfig.c: in lustre_lnet_show_stats, Null pointer 'root' that comes from line 1120 may be dereferenced at line 1197 (after "goto out" in 1133).
3. Result of function that can return NULL may be dereferenced
   • lnet/utils/lnetconfig/liblnetconfig.c: in lustre_lnet_show_stats, Pointer 'root' returned from call to function 'cYAML_create_object' at line 1136 may be NULL and may be dereferenced at line 1197.
4. Possible Buffer Overflow in Following String Operations
   • lnet/utils/lnetconfig/liblnetconfig.c: in liblnetconfig.c, function 'strncpy' will fill whole buffer 'data.cfg_config_u.cfg_net.net_intf' of fixed size (128) with string value and will not leave place for NULL-terminator. Possible buffer boundaries violation in following string operations.
5. Pointer may be dereferenced after it was positively checked for NULL
   • lnet/utils/lnetconfig/liblnetconfig.c: in lustre_lnet_show_stats, Pointer 'root' checked for NULL at line 1137 may be dereferenced at line 1197.

Issue Links

• is related to: LU-4629 Issues found by static analysis tools

Comments

[Amir Shehata (Inactive)]

http://review.whamcloud.com/#/c/13115/

[Amir Shehata (Inactive)]

1. fixed
2. if root == NULL then rc == LUSTRE_CFG_RC_OUT_OF_MEM ad we will enter
if (show_rc == NULL || rc != LUSTRE_CFG_RC_NO_ERR)
cYAML_free_tree(root);
and cYAML_free_tree(root) is written to handle NULL pointer.
3. same as 2
4. buf and ip2net are both checked to ensure they fit into net_intf
5. same as 2