[LU-6542] cYAML_build_error ignores NULL itm pointer on cYAML_create_object call

• Status: Resolved
• Project: Lustre
• Fix Version/s: Lustre 2.8.0
• Type: Bug
• Priority: Minor
• Reporter: Colin Ian King
• Assignee: Amir Shehata (Inactive)
• Resolution: Fixed

Environment

Ubuntu 15.04

• Severity: 3

Description

Static analysis picked up a potential issue in cYAML_build_error() in lnet/utils/cyaml/cyaml.c :

/* look for the command */
cmd_obj = cYAML_get_object_item(r, (const char *)cmd);
if (cmd_obj != NULL && cmd_obj->cy_type == CYAML_TYPE_ARRAY)
itm = cYAML_create_seq_item(cmd_obj);
else if (cmd_obj == NULL)

{ s = cYAML_create_seq(r, cmd); itm = cYAML_create_seq_item(s); }

else if (cmd_obj != NULL && cmd_obj->cy_type != CYAML_TYPE_ARRAY)
goto failed;

err = cYAML_create_object(itm, entity);
if (err == NULL)
goto failed;

From what I can see, cYAML_create_seq_item() has the potential of returning NULL on the tm = cYAML_create_seq_item(cmd_obj) assignments. Later, the err = cYAML_create_object(itm, entity) statement could pass a NULL itm and this calls insert_item() and then cYAML_insert_child() with a NULL parent which silently ignores the NULL parent insert and the original caller gets to cYAML_create_object() has no error return informing it that the insert failed to be actioned. I think some kind of error handling on itm being NULL should be performed rather than silently ignore it.

Comments

[Gerrit Updater]

Amir Shehata ([e-mail]) uploaded a new patch: http://review.whamcloud.com/15778
Subject: LU-6542 lnet: handle cYAML out of memory error
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 14459711a83b29e531fff97e72556ab1427863eb

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch http://review.whamcloud.com/15778/
Subject: LU-6542 lnet: handle cYAML out of memory error
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: ea229b9db1647e167f6c851154a102f1b6fc3fd6

[Peter Jones]

Landed for 2.8