<!-- 
RSS generated by JIRA (9.4.14#940014-sha1:734e6822bbf0d45eff9af51f82432957f73aa32c) at Sat Feb 10 02:00:55 UTC 2024

It is possible to restrict the fields that are returned in this document by specifying the 'field' parameter in your request.
For example, to request only the issue key and summary append 'field=key&field=summary' to the URL of your request.
-->
<rss version="0.92" >
<channel>
    <title>Whamcloud Community JIRA</title>
    <link>https://jira.whamcloud.com</link>
    <description>This file is an XML representation of an issue</description>
    <language>en-us</language>    <build-info>
        <version>9.4.14</version>
        <build-number>940014</build-number>
        <build-date>05-12-2023</build-date>
    </build-info>


<item>
            <title>[LU-6519] potential null pointer dereference in class_newdev</title>
                <link>https://jira.whamcloud.com/browse/LU-6519</link>
                <project id="10000" key="LU">Lustre</project>
                    <description>&lt;p&gt;smatch highlighted this in class_newdev:&lt;/p&gt;

&lt;div class=&quot;preformatted panel&quot; style=&quot;border-width: 1px;&quot;&gt;&lt;div class=&quot;preformattedContent panelContent&quot;&gt;
&lt;pre&gt;        if (result == NULL &amp;amp;&amp;amp; i &amp;gt;= class_devno_max()) {
                CERROR(&quot;all %u OBD devices used, increase MAX_OBD_DEVICES\n&quot;,
                       class_devno_max());
                GOTO(out, result = ERR_PTR(-EOVERFLOW));
        }

        if (IS_ERR(result))
                GOTO(out, result);

        CDEBUG(D_IOCTL, &quot;Adding new device %s (%p)\n&quot;,
               result-&amp;gt;obd_name, result);
&lt;/pre&gt;
&lt;/div&gt;&lt;/div&gt;

&lt;p&gt;So this totally seems to assume that if result == NULL, but we did not go beyond the obd device limit, we are ok to print this NULL pointer?&lt;/p&gt;

&lt;p&gt;I suspect we should chance the IS_ERRO to either result == NULL || IS_ERR?&lt;/p&gt;</description>
                <environment></environment>
        <key id="29710">LU-6519</key>
            <summary>potential null pointer dereference in class_newdev</summary>
                <type id="1" iconUrl="https://jira.whamcloud.com/secure/viewavatar?size=xsmall&amp;avatarId=11303&amp;avatarType=issuetype">Bug</type>
                                            <priority id="4" iconUrl="https://jira.whamcloud.com/images/icons/priorities/minor.svg">Minor</priority>
                        <status id="1" iconUrl="https://jira.whamcloud.com/images/icons/statuses/open.png" description="The issue is open and ready for the assignee to start work on it.">Open</status>
                    <statusCategory id="2" key="new" colorName="default"/>
                                    <resolution id="-1">Unresolved</resolution>
                                        <assignee username="wc-triage">WC Triage</assignee>
                                    <reporter username="green">Oleg Drokin</reporter>
                        <labels>
                    </labels>
                <created>Mon, 27 Apr 2015 04:55:58 +0000</created>
                <updated>Mon, 18 May 2015 09:50:47 +0000</updated>
                                                                                <due></due>
                            <votes>0</votes>
                                    <watches>2</watches>
                                                                            <comments>
                            <comment id="115638" author="uvaze" created="Mon, 18 May 2015 09:50:47 +0000"  >&lt;p&gt;Hi,&lt;br/&gt;
 Following  is analysis from my side -&lt;br/&gt;
Below is relevent part of code of newdev&lt;/p&gt;
&lt;div class=&quot;preformatted panel&quot; style=&quot;border-width: 1px;&quot;&gt;&lt;div class=&quot;preformattedContent panelContent&quot;&gt;
&lt;pre&gt; for (i = 0; i &amp;lt; class_devno_max(); i++) {
                struct obd_device *obd = class_num2obd(i);

        if (obd &amp;amp;&amp;amp; (strcmp(name, obd-&amp;gt;obd_name) == 0)) {
                        CERROR(&quot;Device %s already exists at %d, won&apos;t add\n&quot;,
                               name, i);
                        if (result) {
                                LASSERTF(result-&amp;gt;obd_magic == OBD_DEVICE_MAGIC,
                                         &quot;%p obd_magic %08x != %08x\n&quot;, result,
                                         result-&amp;gt;obd_magic, OBD_DEVICE_MAGIC);
                                LASSERTF(result-&amp;gt;obd_minor == new_obd_minor,
                                         &quot;%p obd_minor %d != %d\n&quot;, result,
                                         result-&amp;gt;obd_minor, new_obd_minor);

                                obd_devs[result-&amp;gt;obd_minor] = NULL;
                                result-&amp;gt;obd_name[0]=&apos;\0&apos;;
                         }
                        result = ERR_PTR(-EEXIST);
                        break;
                }
                if (!result &amp;amp;&amp;amp; !obd) {
                        result = newdev;
                        result-&amp;gt;obd_minor = i;
                        new_obd_minor = i;
                        result-&amp;gt;obd_type = type;
                        strncpy(result-&amp;gt;obd_name, name,
                                sizeof(result-&amp;gt;obd_name) - 1);
        obd_devs[i] = result;
                }
        }
    write_unlock(&amp;amp;obd_dev_lock);

        if (result == NULL &amp;amp;&amp;amp; i &amp;gt;= class_devno_max()) {
                CERROR(&quot;all %u OBD devices used, increase MAX_OBD_DEVICES\n&quot;,
                       class_devno_max());
        GOTO(out, result = ERR_PTR(-EOVERFLOW));
        }
&lt;/pre&gt;
&lt;/div&gt;&lt;/div&gt;

&lt;p&gt;1. if result is NULL and loop is completed this means no slot is found for new obd. This case is handled ihere -&lt;/p&gt;

&lt;p&gt; if (result == NULL &amp;amp;&amp;amp; i &amp;gt;= class_devno_max()) &lt;/p&gt;
{
                CERROR(&quot;all %u OBD devices used, increase MAX_OBD_DEVICES\n&quot;,
                       class_devno_max());
        GOTO(out, result = ERR_PTR(-EOVERFLOW));
               }


&lt;p&gt;and result value is reassigned.  We printing max no of obd devices.&lt;br/&gt;
 2. If  we break out of loop because obd exists then result will have error code -EEXIST so result will no be NULL&lt;br/&gt;
Out code frees the menory allocated to newdev. &lt;br/&gt;
This code seems fine to me and  probabally a false alarm  from the tool.&lt;br/&gt;
Please confirm.&lt;/p&gt;

&lt;p&gt;-Ulka&lt;/p&gt;</comment>
                    </comments>
                    <attachments>
                    </attachments>
                <subtasks>
                    </subtasks>
                <customfields>
                                                                                                                                                                                            <customfield id="customfield_10890" key="com.atlassian.jira.plugins.jira-development-integration-plugin:devsummary">
                        <customfieldname>Development</customfieldname>
                        <customfieldvalues>
                            
                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                        <customfield id="customfield_10390" key="com.pyxis.greenhopper.jira:gh-lexo-rank">
                        <customfieldname>Rank</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>1|hzxbrb:</customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                <customfield id="customfield_10090" key="com.pyxis.greenhopper.jira:gh-global-rank">
                        <customfieldname>Rank (Obsolete)</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>9223372036854775807</customfieldvalue>
                        </customfieldvalues>
                    </customfield>
                                                                                            <customfield id="customfield_10060" key="com.atlassian.jira.plugin.system.customfieldtypes:select">
                        <customfieldname>Severity</customfieldname>
                        <customfieldvalues>
                                <customfieldvalue key="10022"><![CDATA[3]]></customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                        </customfields>
    </item>
</channel>
</rss>