diff options
| author | Bhumika Goyal <bgoyal@redhat.com> | 2018-08-07 15:28:13 +0530 |
|---|---|---|
| committer | Amar Tumballi <amarts@redhat.com> | 2018-08-21 05:01:08 +0000 |
| commit | 6fa531c57c633827283fba6a3cdaa1c68976ccb7 (patch) | |
| tree | 200f300af453ad45e7e7491f989757170d01adb8 /xlators/protocol/client/src/client-helpers.c | |
| parent | 2348b8ae6ce02f83069d01478a31bb2498cc6183 (diff) | |
xlators: protocol: Fix deferencing pointer after free coverity issues
The pointer of type struct iobuf * is getting dereferenced after
getting freed by iobuf_unref function. Therefore, move this function
after all the dereferences of this pointer type.
Also, it is useful coding standard to have iobuf_unref just after
iobref_add. So, move iobref_add too.
Occurences found using Coccinelle script:
@@
identifier rsphdr_iobuf;
expression E;
identifier func;
@@
*iobuf_unref(rsphdr_iobuf);
...
*E = func(rsphdr_iobuf);
Fixes CID: 1390517, 1390278, 1388666, 1356588, 1356587 at [1].
and also some more occurences which were found using the above script but not
caught by Coverity.
[1]. https://scan6.coverity.com/reports.htm#v42388/p10714/fileInstanceId=84384920&defectInstanceId=25600709&mergedDefectId=1388666
Change-Id: I579e9d12698f14e9e24bc926c6efef16bac5c06c
updates: bz#789278
Signed-off-by: Bhumika Goyal <bgoyal@redhat.com>
Diffstat (limited to 'xlators/protocol/client/src/client-helpers.c')
| -rw-r--r-- | xlators/protocol/client/src/client-helpers.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/xlators/protocol/client/src/client-helpers.c b/xlators/protocol/client/src/client-helpers.c index 75cfd55b8fa..ddb88795fee 100644 --- a/xlators/protocol/client/src/client-helpers.c +++ b/xlators/protocol/client/src/client-helpers.c @@ -1268,15 +1268,14 @@ client_handle_fop_requirements (xlator_t *this, call_frame_t *frame, } } - iobref_add (*rsp_iobref, rsp_iobuf); - iobuf_unref (rsp_iobuf); - if (*rsp_count + 1 >= MAX_IOVEC) { op_errno = ENOMEM; goto out; } rsp_vector[*rsp_count].iov_base = iobuf_ptr (rsp_iobuf); rsp_vector[*rsp_count].iov_len = iobuf_pagesize (rsp_iobuf); + iobref_add (*rsp_iobref, rsp_iobuf); + iobuf_unref (rsp_iobuf); rsp_iobuf = NULL; if (args->size > rsp_vector[*rsp_count].iov_len) { gf_msg (this->name, GF_LOG_WARNING, ENOMEM, @@ -2371,15 +2370,14 @@ client_handle_fop_requirements_v2 (xlator_t *this, call_frame_t *frame, } } - iobref_add (*rsp_iobref, rsp_iobuf); - iobuf_unref (rsp_iobuf); - if (*rsp_count + 1 >= MAX_IOVEC) { op_errno = ENOMEM; goto out; } rsp_vector[*rsp_count].iov_base = iobuf_ptr (rsp_iobuf); rsp_vector[*rsp_count].iov_len = iobuf_pagesize (rsp_iobuf); + iobref_add (*rsp_iobref, rsp_iobuf); + iobuf_unref (rsp_iobuf); rsp_iobuf = NULL; if (args->size > rsp_vector[*rsp_count].iov_len) { gf_msg (this->name, GF_LOG_WARNING, ENOMEM, |