[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-trivial] [Qemu-devel] [PATCH for 2.10 27/35] syscall: fix dere
From: |
Laurent Vivier |
Subject: |
Re: [Qemu-trivial] [Qemu-devel] [PATCH for 2.10 27/35] syscall: fix dereference of undefined pointer |
Date: |
Tue, 25 Jul 2017 09:25:44 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 |
Le 24/07/2017 à 23:26, Peter Maydell a écrit :
> On 24 July 2017 at 19:27, Philippe Mathieu-Daudé <address@hidden> wrote:
>> Clang's scan-build-5.0 reports:
>>
>> linux-user/syscall.c:5581:9: warning: Dereference of undefined pointer value
>> if (*host_rt_dev_ptr != 0) {
>> ^~~~~~~~~~~~~~~~
>>
>> Reported-by: Clang Static Analyzer
>> Suggested-by: Laurent Vivier <address@hidden>
>> Signed-off-by: Philippe Mathieu-Daudé <address@hidden>
>> ---
>> linux-user/syscall.c | 3 ++-
>> 1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
>> index fcd20fa276..e79b5baec4 100644
>> --- a/linux-user/syscall.c
>> +++ b/linux-user/syscall.c
>> @@ -5524,7 +5524,7 @@ static abi_long do_ioctl_rt(const IOCTLEntry *ie,
>> uint8_t *buf_temp,
>> int target_size;
>> void *argptr;
>> abi_ulong *target_rt_dev_ptr;
>> - unsigned long *host_rt_dev_ptr;
>> + unsigned long *host_rt_dev_ptr = NULL;
>> abi_long ret;
>> int i;
>>
>> @@ -5570,6 +5570,7 @@ static abi_long do_ioctl_rt(const IOCTLEntry *ie,
>> uint8_t *buf_temp,
>> unlock_user(argptr, arg, 0);
>>
>> ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
>> + assert(host_rt_dev_ptr);
>
> There's not much point in this assert because it doesn't
> tell us anything we're not about to find out immediately
> by dereferencing the pointer...
It's just to shut off the warning.
What I said in the comment of the previous version of this patch:
I think we should "assert(host_rt_dev_ptr)" here. It's a bug if
host_rt_dev_ptr is not set.
The "for" loop scans the structure to find the rt_dev field, and we
should always enter in the first "if", so "host_rt_dev_ptr" is always set.
Thanks,
Laurent
- Re: [Qemu-trivial] [Qemu-devel] [PATCH for 2.10 23/35] m68k/translate: fix incorrect copy/paste, (continued)
[Qemu-trivial] [PATCH for 2.10 24/35] linux-user/sh4: fix incorrect memory write, Philippe Mathieu-Daudé, 2017/07/24
[Qemu-trivial] [PATCH for 2.10 25/35] linux-user: extract is_error() out of syscall.c, Philippe Mathieu-Daudé, 2017/07/24
[Qemu-trivial] [PATCH for 2.10 27/35] syscall: fix dereference of undefined pointer, Philippe Mathieu-Daudé, 2017/07/24
[Qemu-trivial] [PATCH for 2.10 26/35] linux-user: use is_error() to avoid warnings and make the code clearer, Philippe Mathieu-Daudé, 2017/07/24
[Qemu-trivial] [PATCH for 2.10 29/35] syscall: fix out-of-bound memory access, Philippe Mathieu-Daudé, 2017/07/24
[Qemu-trivial] [PATCH for 2.10 30/35] syscall: fix use of uninitialized values, Philippe Mathieu-Daudé, 2017/07/24
[Qemu-trivial] [PATCH for 2.10 31/35] syscall: replace strcpy() by g_strlcpy(), Philippe Mathieu-Daudé, 2017/07/24
[Qemu-trivial] [PATCH for 2.10 32/35] timer/pxa2xx: silent warning about out-of-bound memory access, Philippe Mathieu-Daudé, 2017/07/24