> Dawson Engler wrote:
> >
> > Hi All,
> >
> > Enclosed are 103 potential errors where code gets a pointer from a
> > possibly-failing routine (kmalloc, etc) and dereferences it without
> >
> > [BUG] osst_do_scsi will never return NULL if argument SRpnt isn't NULL. But they copy SRpnt back by *aSRpnt, implies it could be NULL
>
> No. It implies SRpnt could have changed. The functions flagged
> (osst_read_back_buffer_and_rewrite and osst_reposition_and_retry)
> cannot be reached with SRpnt == NULL. So these are false alarms.
these are false positives if osst_read_back_buffer_and rewrite can't be
reached with SRpnt == NULL. It seems that osst_do_scsi will not change
SRpnt unless it is NULL though. In other words, SRpnt is changed by
osst_do_scsi <=> the initial argument SRpnt == NULL. Probabaly the pointer
aSRpnt is useless.
>
> > /u2/engler/mc/oses/linux/2.4.4/drivers/scsi/osst.c:1163:osst_read_back_buffer_and_rewrite: ERROR:NULL:1111:1163: Using unknown ptr "SRpnt" illegally! set by 'osst_do_scsi':1163 [nbytes = 216]
> > #if DEBUG
> > if (debugging)
> > printk(OSST_DEB_MSG "osst%d: About to attempt to write to frame %d\n", dev, new_block+i);
> > #endif
> > SRpnt = osst_do_scsi(SRpnt, STp, cmd, OS_FRAME_SIZE, SCSI_DATA_WRITE,
> > Start --->
> > STp->timeout, MAX_WRITE_RETRIES, TRUE);
> >
> > ... DELETED 46 lines ...
> >
> > }
> > }
> > if (flag) {
> > if ((SRpnt->sr_sense_buffer[ 2] & 0x0f) == 13 &&
> > SRpnt->sr_sense_buffer[12] == 0 &&
> > Error --->
> > SRpnt->sr_sense_buffer[13] == 2) {
> > printk(KERN_ERR "osst%d: Volume overflow in write error recovery\n", dev);
> > vfree((void *)buffer);
> > return (-EIO); /* hit end of tape = fail */
> >
>
> Regards. Willem Riede.
>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/