2017-12-21 15:54:35

by Vasyl Gomonovych

[permalink] [raw]
Subject: [PATCH] epoll: fix dereferenced before check pt

This patch fixes the warning reported by smatch:

fs/eventpoll.c:889 ep_item_poll() warn: variable dereferenced before check 'pt'

Signed-off-by: Vasyl Gomonovych <[email protected]>
---
fs/eventpoll.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index afd548ebc328..fc772a1f1396 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -879,7 +879,8 @@ static unsigned int ep_item_poll(struct epitem *epi, poll_table *pt, int depth)
struct eventpoll *ep;
bool locked;

- pt->_key = epi->event.events;
+ if (pt)
+ pt->_key = epi->event.events;
if (!is_file_epoll(epi->ffd.file))
return epi->ffd.file->f_op->poll(epi->ffd.file, pt) &
epi->event.events;
--
1.9.1


2017-12-22 00:02:11

by Al Viro

[permalink] [raw]
Subject: Re: [PATCH] epoll: fix dereferenced before check pt

On Thu, Dec 21, 2017 at 04:54:17PM +0100, Vasyl Gomonovych wrote:
> This patch fixes the warning reported by smatch:
>
> fs/eventpoll.c:889 ep_item_poll() warn: variable dereferenced before check 'pt'

... and of course, that is all the analysis one might want - the tool has
spoken. Except that the only thing proven is that the tool is either misused
or just plain crappy.

Callers of ep_item_poll() are easily found - it's static, so they all are in
the same file. All four of them -
if (ep_item_poll(epi, &pt, depth)) {
revents = ep_item_poll(epi, &epq.pt, 1);
if (ep_item_poll(epi, &pt, 1)) {
revents = ep_item_poll(epi, &pt, 1);

Figuring out why an address of a local variable or of a field thereof can never
be NULL is left as an exercise for an introductory course on C.

"Fixing warnings" is bloody wrong - warning (from any tool) is a heuristic
pointing to a place that might be worth looking into. In cases when you've
found a real problem with help from some tool, sure, go ahead and credit that
tool in the commit message. Along with the description of the problem
you've found.