[Qemu-devel] [PULL 15/25] syscall: fix dereference of undefined pointer

Michael Tokarev posted 25 patches 8 years, 6 months ago
[Qemu-devel] [PULL 15/25] syscall: fix dereference of undefined pointer
Posted by Michael Tokarev 8 years, 6 months ago
From: Philippe Mathieu-Daudé <f4bug@amsat.org>

linux-user/syscall.c:5581:9: warning: Dereference of undefined pointer value
    if (*host_rt_dev_ptr != 0) {
        ^~~~~~~~~~~~~~~~

Reported-by: Clang Static Analyzer
Suggested-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/syscall.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 003943b736..71d45a9963 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -5573,6 +5573,7 @@ static abi_long do_ioctl_rt(const IOCTLEntry *ie, uint8_t *buf_temp,
                                     field_types, THUNK_HOST);
     }
     unlock_user(argptr, arg, 0);
+    assert(host_rt_dev_ptr);
 
     ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
     if (*host_rt_dev_ptr != 0) {
-- 
2.11.0


Re: [Qemu-devel] [PULL 15/25] syscall: fix dereference of undefined pointer
Posted by Peter Maydell 8 years, 6 months ago
On 31 July 2017 at 11:21, Michael Tokarev <mjt@tls.msk.ru> wrote:
> From: Philippe Mathieu-Daudé <f4bug@amsat.org>
>
> linux-user/syscall.c:5581:9: warning: Dereference of undefined pointer value
>     if (*host_rt_dev_ptr != 0) {
>         ^~~~~~~~~~~~~~~~
>
> Reported-by: Clang Static Analyzer
> Suggested-by: Laurent Vivier <lvivier@redhat.com>
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> Reviewed-by: Laurent Vivier <laurent@vivier.eu>
> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
> ---
>  linux-user/syscall.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 003943b736..71d45a9963 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -5573,6 +5573,7 @@ static abi_long do_ioctl_rt(const IOCTLEntry *ie, uint8_t *buf_temp,
>                                      field_types, THUNK_HOST);
>      }
>      unlock_user(argptr, arg, 0);
> +    assert(host_rt_dev_ptr);
>
>      ret = get_errno(safe_ioctl(fd, ie->host_cmd, buf_temp));
>      if (*host_rt_dev_ptr != 0) {
> --

This appears not to build with all versions of gcc; the ones in my
test set were fine but the gcc 4.6.3 that some of the travis
configs use complains:
linux-user/syscall.c: In function 'do_ioctl_rt':
linux-user/syscall.c:5577:37: error: 'host_rt_dev_ptr' may be used uninitialized

It's not obvious to me that the compiler is wrong, either,
though why it complains about the assert but not the if()
I have no idea.

In any case, I'm going to revert this commit to fix the
Travis builds; we can have another go at it later.

thanks
-- PMM