[CRIU] New Defects reported by Coverity Scan for crtools
Cyrill Gorcunov
gorcunov at gmail.com
Mon Aug 4 23:50:07 PDT 2014
Just in case if someone interested to take a look (latest criu @master).
I'll take a look into vdso code as well a bit later.
On Mon, Aug 04, 2014 at 11:44:07PM -0700, scan-admin at coverity.com wrote:
>
> Hi,
>
>
> Please find the latest report on new defect(s) introduced to crtools found with Coverity Scan.
>
> Defect(s) Reported-by: Coverity Scan
> Showing 9 of 9 defect(s)
>
>
> ** CID 1230183: Unchecked return value (CHECKED_RETURN)
> /cr-restore.c: 749 in zombie_prepare_signals()
>
> ** CID 1230182: Logically dead code (DEADCODE)
> /arch/x86/vdso-pie.c: 406 in vdso_proxify()
>
> ** CID 1230181: Dereference after null check (FORWARD_NULL)
> /files-reg.c: 463 in create_link_remap()
>
> ** CID 1230180: Argument cannot be negative (NEGATIVE_RETURNS)
> /files.c: 1011 in fchroot()
>
> ** CID 1230179: Resource leak (RESOURCE_LEAK)
> /cgroup.c: 270 in add_cgroup()
>
> ** CID 1230178: Dereference before null check (REVERSE_INULL)
> /files-reg.c: 465 in create_link_remap()
>
> ** CID 1230177: Dereference before null check (REVERSE_INULL)
> /proc_parse.c: 1542 in parse_task_cgroup()
>
> ** CID 1230176: Double close (USE_AFTER_FREE)
> /files.c: 1115 in prepare_fs_pid()
>
> ** CID 1230175: Write to pointer after free (USE_AFTER_FREE)
> /util.c: 797 in split()
>
>
> ________________________________________________________________________________________________________
> *** CID 1230183: Unchecked return value (CHECKED_RETURN)
> /cr-restore.c: 749 in zombie_prepare_signals()
> 743 sigprocmask(SIG_UNBLOCK, &blockmask, NULL);
> 744
> 745 memset(&act, 0, sizeof(act));
> 746 act.sa_handler = SIG_DFL;
> 747
> 748 for (sig = 1; sig <= SIGMAX; sig++)
> >>> CID 1230183: Unchecked return value (CHECKED_RETURN)
> >>> No check of the return value of "sigaction(sig, &act, NULL)".
> 749 sigaction(sig, &act, NULL);
> 750 }
> 751
> 752 #define SIG_FATAL_MASK ( \
> 753 (1 << SIGHUP) |\
> 754 (1 << SIGINT) |\
>
> ________________________________________________________________________________________________________
> *** CID 1230182: Logically dead code (DEADCODE)
> /arch/x86/vdso-pie.c: 406 in vdso_proxify()
> 400 } else {
> 401 ret = vdso_remap(who, vdso_rt_parked_at, vma_vvar->start, vvar_vma_size(sym_rt));
> 402 vdso_rt_parked_at += vvar_vma_size(sym_rt);
> 403 ret |= vdso_remap(who, vdso_rt_parked_at, vma_vdso->start, vdso_vma_size(sym_rt));
> 404 }
> 405 } else
> >>> CID 1230182: Logically dead code (DEADCODE)
> >>> Execution cannot reach this statement "ret = vdso_remap(who, vdso_...".
> 406 ret = vdso_remap(who, vdso_rt_parked_at, vma_vdso->start, vdso_vma_size(sym_rt));
> 407
> 408 return ret;
> 409 }
> 410
> 411 /*
>
> ________________________________________________________________________________________________________
> *** CID 1230181: Dereference after null check (FORWARD_NULL)
> /files-reg.c: 463 in create_link_remap()
> 457 * we keep all data in memory.
> 458 */
> 459 rlb = xmalloc(sizeof(*rlb));
> 460 if (rlb)
> 461 rlb->path = strdup(link_name);
> 462
> >>> CID 1230181: Dereference after null check (FORWARD_NULL)
> >>> Dereferencing null pointer "rlb".
> 463 rlb->mnt_ns = nsid;
> 464
> 465 if (!rlb || !rlb->path) {
> 466 pr_perror("Can't register rollback for %s", path);
> 467 xfree(rlb ? rlb->path : NULL);
> 468 xfree(rlb);
>
> ________________________________________________________________________________________________________
> *** CID 1230180: Argument cannot be negative (NEGATIVE_RETURNS)
> /files.c: 1011 in fchroot()
> 1005 *
> 1006 * But since there might be no /proc mount in our mount
> 1007 * namespace, we will have to ... workaround it.
> 1008 */
> 1009
> 1010 proc = get_service_fd(PROC_FD_OFF);
> >>> CID 1230180: Argument cannot be negative (NEGATIVE_RETURNS)
> >>> "proc" is passed to a parameter that cannot be negative.
> 1011 if (fchdir(proc) < 0) {
> 1012 pr_perror("Can't chdir to proc");
> 1013 return -1;
> 1014 }
> 1015
> 1016 sprintf(fd_path, "./self/fd/%d", fd);
>
> ________________________________________________________________________________________________________
> *** CID 1230179: Resource leak (RESOURCE_LEAK)
> /cgroup.c: 270 in add_cgroup()
> 264 current_controller->n_heads++;
> 265 break;
> 266 }
> 267
> 268 INIT_LIST_HEAD(&ncd->children);
> 269 ncd->n_children = 0;
> >>> CID 1230179: Resource leak (RESOURCE_LEAK)
> >>> Variable "ncd" going out of scope leaks the storage it points to.
> 270 return 0;
> 271 } else
> 272 return 0;
> 273
> 274 out:
> 275 if (ncd)
>
> ________________________________________________________________________________________________________
> *** CID 1230178: Dereference before null check (REVERSE_INULL)
> /files-reg.c: 465 in create_link_remap()
> 459 rlb = xmalloc(sizeof(*rlb));
> 460 if (rlb)
> 461 rlb->path = strdup(link_name);
> 462
> 463 rlb->mnt_ns = nsid;
> 464
> >>> CID 1230178: Dereference before null check (REVERSE_INULL)
> >>> Null-checking "rlb" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
> 465 if (!rlb || !rlb->path) {
> 466 pr_perror("Can't register rollback for %s", path);
> 467 xfree(rlb ? rlb->path : NULL);
> 468 xfree(rlb);
> 469 return -1;
> 470 }
>
> ________________________________________________________________________________________________________
> *** CID 1230177: Dereference before null check (REVERSE_INULL)
> /proc_parse.c: 1542 in parse_task_cgroup()
> 1536 * 4:cpu,cpuacct:/
> 1537 * 3:cpuset:/
> 1538 * 2:name=systemd:/user.slice/user-1000.slice/session-1.scope
> 1539 */
> 1540 name = strchr(buf, ':') + 1;
> 1541 path = strchr(name, ':');
> >>> CID 1230177: Dereference before null check (REVERSE_INULL)
> >>> Null-checking "name" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
> 1542 if (!name || !path) {
> 1543 pr_err("Failed parsing cgroup %s\n", buf);
> 1544 xfree(ncc);
> 1545 goto err;
> 1546 }
> 1547 e = strchr(name, '\n');
>
> ________________________________________________________________________________________________________
> *** CID 1230176: Double close (USE_AFTER_FREE)
> /files.c: 1115 in prepare_fs_pid()
> 1109 ok:
> 1110 return 0;
> 1111
> 1112 out_f:
> 1113 fs_entry__free_unpacked(fe, NULL);
> 1114 out_i:
> >>> CID 1230176: Double close (USE_AFTER_FREE)
> >>> Calling "close(int)" closes handle "ifd" which has already been closed.
> 1115 close(ifd);
> 1116 out:
> 1117 return -1;
> 1118 }
> 1119
> 1120 int shared_fdt_prepare(struct pstree_item *item)
>
> ________________________________________________________________________________________________________
> *** CID 1230175: Write to pointer after free (USE_AFTER_FREE)
> /util.c: 797 in split()
> 791
> 792 if (!(*out)[i]) {
> 793 int j;
> 794 for (j = 0; j < i; j++)
> 795 xfree((*out)[j]);
> 796 xfree(out);
> >>> CID 1230175: Write to pointer after free (USE_AFTER_FREE)
> >>> Dereferencing freed pointer "out".
> 797 *out = NULL;
> 798 *n = -1;
> 799 return;
> 800 }
> 801
> 802 i++;
> 803 } while(cur);
More information about the CRIU
mailing list