summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDmitry Eremin <dmitry.eremin@intel.com>2014-04-27 17:06:34 (GMT)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2014-04-27 17:21:39 (GMT)
commit0dd08092c2ed1f949adc10638784c3212cdb59c3 (patch)
tree24c6cabbb63bbabcf8a07e4bb3a0e906f1990484
parent88291a7a6b3beb8a471cf347c4f36c85f9fc59e5 (diff)
downloadlinux-0dd08092c2ed1f949adc10638784c3212cdb59c3.tar.xz
staging/lustre/gss: fix few issues found by Klocwork Insight tool
Array 'message_buf' of size 500 may use index value(s) -1 Object 'enc_key.data' was freed at line 164 after being freed by calling 'free' at line 150. Also there are 3 similar errors on line(s) 164. Suspicious dereference of pointer 'vmsg' before NULL check at line 187. Also there are 2 similar errors on line(s) 196, 205. Suspicious dereference of pointer 'rmsg' before NULL check at line 191. Also there are 2 similar errors on line(s) 200, 209. Signed-off-by: Dmitry Eremin <dmitry.eremin@intel.com> Reviewed-on: http://review.whamcloud.com/9274 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4629 Reviewed-by: John L. Hammond <john.hammond@intel.com> Reviewed-by: James Simmons <uja.ornl@gmail.com> Signed-off-by: Oleg Drokin <oleg.drokin@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/staging/lustre/lustre/ptlrpc/gss/gss_bulk.c12
1 files changed, 6 insertions, 6 deletions
diff --git a/drivers/staging/lustre/lustre/ptlrpc/gss/gss_bulk.c b/drivers/staging/lustre/lustre/ptlrpc/gss/gss_bulk.c
index 7852bf3..93794bd 100644
--- a/drivers/staging/lustre/lustre/ptlrpc/gss/gss_bulk.c
+++ b/drivers/staging/lustre/lustre/ptlrpc/gss/gss_bulk.c
@@ -176,31 +176,31 @@ int gss_cli_ctx_unwrap_bulk(struct ptlrpc_cli_ctx *ctx,
switch (SPTLRPC_FLVR_SVC(req->rq_flvr.sf_rpc)) {
case SPTLRPC_SVC_NULL:
vmsg = req->rq_repdata;
+ LASSERT(vmsg != NULL && vmsg->lm_bufcount >= 3);
voff = vmsg->lm_bufcount - 1;
- LASSERT(vmsg && vmsg->lm_bufcount >= 3);
rmsg = req->rq_reqbuf;
+ LASSERT(rmsg != NULL && rmsg->lm_bufcount >= 3);
roff = rmsg->lm_bufcount - 1; /* last segment */
- LASSERT(rmsg && rmsg->lm_bufcount >= 3);
break;
case SPTLRPC_SVC_AUTH:
case SPTLRPC_SVC_INTG:
vmsg = req->rq_repdata;
+ LASSERT(vmsg != NULL && vmsg->lm_bufcount >= 4);
voff = vmsg->lm_bufcount - 2;
- LASSERT(vmsg && vmsg->lm_bufcount >= 4);
rmsg = req->rq_reqbuf;
+ LASSERT(rmsg != NULL && rmsg->lm_bufcount >= 4);
roff = rmsg->lm_bufcount - 2; /* second last segment */
- LASSERT(rmsg && rmsg->lm_bufcount >= 4);
break;
case SPTLRPC_SVC_PRIV:
vmsg = req->rq_repdata;
+ LASSERT(vmsg != NULL && vmsg->lm_bufcount >= 2);
voff = vmsg->lm_bufcount - 1;
- LASSERT(vmsg && vmsg->lm_bufcount >= 2);
rmsg = req->rq_clrbuf;
+ LASSERT(rmsg != NULL && rmsg->lm_bufcount >= 2);
roff = rmsg->lm_bufcount - 1; /* last segment */
- LASSERT(rmsg && rmsg->lm_bufcount >= 2);
break;
default:
LBUG();