[Drbd-dev] [bug report] drbd: Backport the "events2" command

[Lars Ellenberg]

On Thu, Feb 23, 2017 at 06:55:08PM +0300, Dan Carpenter wrote:
> Hello Andreas Gruenbacher,

Andreas has since moved to more exiting challenges :)

> The patch a29728463b25: "drbd: Backport the "events2" command" from
> Jul 31, 2014, leads to the following static checker warning:
> 
> 	drivers/block/drbd/drbd_nl.c:4934 get_initial_state()
> 	error: dereferencing freed memory 'skb'
> 
> drivers/block/drbd/drbd_nl.c
>   4880  static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb)
>   4881  {
>   4882          struct drbd_state_change *state_change = (struct drbd_state_change *)cb->args[0];
>   4883          unsigned int seq = cb->args[2];
>   4884          unsigned int n;
>   4885          enum drbd_notification_type flags = 0;
>   4886  
>   4887          /* There is no need for taking notification_mutex here: it doesn't
>   4888             matter if the initial state events mix with later state chage
>   4889             events; we can always tell the events apart by the NOTIFY_EXISTS
>   4890             flag. */
>   4891  
>   4892          cb->args[5]--;
>   4893          if (cb->args[5] == 1) {
>   4894                  notify_initial_state_done(skb, seq);
>                                                   ^^^
> skb is freed on error inside notify_initial_state_done().

So notify_resource_state_change needs to become non void,
and we need to change notify_initial_state_done(); goto out;
to return notify_initial_state_done();

right?

-- 
: Lars Ellenberg
: LINBIT | Keeping the Digital World Running
: DRBD -- Heartbeat -- Corosync -- Pacemaker
: R&D, Integration, Ops, Consulting, Support

DRBD® and LINBIT® are registered trademarks of LINBIT