[prev in list] [next in list] [prev in thread] [next in thread] 

List:       drbd-dev
Subject:    Re: [Drbd-dev] [bug report] drbd: Backport the "events2" command
From:       Lars Ellenberg <lars.ellenberg () linbit ! com>
Date:       2017-02-24 15:29:42
Message-ID: 20170224152942.GY21236 () soda ! linbit
[Download RAW message or body]

On Thu, Feb 23, 2017 at 06:55:08PM +0300, Dan Carpenter wrote:
> Hello Andreas Gruenbacher,

Andreas has since moved to more exiting challenges :)

> The patch a29728463b25: "drbd: Backport the "events2" command" from
> Jul 31, 2014, leads to the following static checker warning:
> 
> 	drivers/block/drbd/drbd_nl.c:4934 get_initial_state()
> 	error: dereferencing freed memory 'skb'
> 
> drivers/block/drbd/drbd_nl.c
>   4880  static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb)
>   4881  {
>   4882          struct drbd_state_change *state_change = (struct drbd_state_change *)cb->args[0];
>   4883          unsigned int seq = cb->args[2];
>   4884          unsigned int n;
>   4885          enum drbd_notification_type flags = 0;
>   4886  
>   4887          /* There is no need for taking notification_mutex here: it doesn't
>   4888             matter if the initial state events mix with later state chage
>   4889             events; we can always tell the events apart by the NOTIFY_EXISTS
>   4890             flag. */
>   4891  
>   4892          cb->args[5]--;
>   4893          if (cb->args[5] == 1) {
>   4894                  notify_initial_state_done(skb, seq);
>                                                   ^^^
> skb is freed on error inside notify_initial_state_done().

So notify_resource_state_change needs to become non void,
and we need to change notify_initial_state_done(); goto out;
to return notify_initial_state_done();

right?

-- 
: Lars Ellenberg
: LINBIT | Keeping the Digital World Running
: DRBD -- Heartbeat -- Corosync -- Pacemaker
: R&D, Integration, Ops, Consulting, Support

DRBD® and LINBIT® are registered trademarks of LINBIT
_______________________________________________
drbd-dev mailing list
drbd-dev@lists.linbit.com
http://lists.linbit.com/mailman/listinfo/drbd-dev
[prev in list] [next in list] [prev in thread] [next in thread]