[LU-6521] Unitialized variable access in ll_layout_fetch

Mon, 27 Apr 2015 05:08:16 +0000

smatch highlighted this piece in ll_layout_fetch():

        struct ptlrpc_request *req;
...
        rc = ll_get_default_mdsize(sbi, &lmmsize);
        if (rc == 0)
                rc = md_getxattr(sbi->ll_md_exp, ll_inode2fid(inode), oc,
                                OBD_MD_FLXATTR, XATTR_NAME_LOV, NULL, 0,
                                lmmsize, 0, &req);
        capa_put(oc);
        if (rc < 0)
                RETURN(rc);

        body = req_capsule_server_get(&req->rq_pill, &RMF_MDT_BODY);

So if ll_get_default_mdsize returns a value bigger than 0, we access uninitialized req variable

Whamcloud Community JIRA

[LU-6521] Unitialized variable access in ll_layout_fetch