Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d633c059 authored by Sharath Chandra Vurukala's avatar Sharath Chandra Vurukala Committed by Gerrit - the friendly Code Review server
Browse files

rmnet: shs: Fix KW reported issues 



Suspicious dereference of pointer 'ptr' before NULL check at line 673
rmnet_shs_flush_core()
Suspicious dereference of pointer 'ptr' before NULL check at line 874
rmnet_shs_flush_lock_table()
'hash2stamp' might be used uninitialized in this function.
rmnet_shs_flush_node()
Pointer 'hnode' checked for NULL at line 334 will be dereferenced at line 333.
rmnet_shs_wq_get_new_hstat_node()
Pointer 'ep' checked for NULL at line 418 will be dereferenced at line 416.
rmnet_shs_wq_update_hstat_rps_msk()
Pointer 'ep' checked for NULL at line 779 will be dereferenced at line 778.
rmnet_shs_wq_get_dev_rps_msk()
Pointer 'ep' checked for NULL at line 926 will be dereferenced at line 925.
rmnet_shs_wq_find_cpu_and_move_flows()
Pointer 'ep' checked for NULL at line 1075 will be dereferenced at line 1074.
rmnet_shs_wq_refresh_new_flow_list()
Pointer 'ep' checked for NULL at line 1099 will be dereferenced at line 1098.
rmnet_shs_wq_get_lpwr_cpu_new_flow()
Pointer 'ep' checked for NULL at line 1148 will be dereferenced at line 1147.
rmnet_shs_wq_get_perf_cpu_new_flow()
Pointer 'ep' checked for NULL at line 1276 will be dereferenced at line 1275.
rmnet_shs_wq_reset_ep_active()
Pointer 'ep' checked for NULL at line 1290 will be dereferenced at line 1289.
rmnet_shs_wq_set_ep_active()
Pointer 'ep' checked for NULL at line 1305 will be dereferenced at line 1303.
rmnet_shs_wq_refresh_ep_masks()
Pointer 'hnode' checked for NULL at line 1349 will be dereferenced at line 1348.
rmnet_shs_wq_update_stats()
Suspicious dereference of pointer 'ptr' before NULL check at line 1209
rmnet_shs_wq_cleanup_hash_tbl()
Suspicious dereference of pointer 'ptr' before NULL check at line 1390
rmnet_shs_wq_clean_ep_tbl()

Change-Id: Ic978ddcd246efaaae045b890d15c1e7c3bb6bca8
Signed-off-by: default avatarSharath Chandra Vurukala <sharathv@codeaurora.org>
parent fb652f1b

drivers/rmnet/shs/rmnet_shs_main.c

+5 −5
Original line number Diff line number Diff line
@@ -808,12 +808,12 @@ static void rmnet_shs_flush_core_work(struct work_struct *work) 
/* Flushes all the packets parked in order for this flow */

void rmnet_shs_flush_node(struct rmnet_shs_skbn_s *node, u8 ctext)

{

	struct sk_buff *skb;

	struct sk_buff *skb = NULL;

	struct sk_buff *nxt_skb = NULL;

	u32 skbs_delivered = 0;

	u32 skb_bytes_delivered = 0;

	u32 hash2stamp;

	u8 map, maplen;

	u32 hash2stamp = 0; /* the default value of skb->hash*/

	u8 map = 0, maplen = 0;



	if (!node->skb_list.head)

		return;
@@ -969,8 +969,8 @@ int rmnet_shs_chk_and_flush_node(struct rmnet_shs_skbn_s *node, 


void rmnet_shs_flush_lock_table(u8 flsh, u8 ctxt)

{

	struct rmnet_shs_skbn_s *n;

	struct list_head *ptr, *next;

	struct rmnet_shs_skbn_s *n = NULL;

	struct list_head *ptr = NULL, *next = NULL;

	int cpu_num;

	u32 cpu_tail;

	u32 num_pkts_flush = 0;

drivers/rmnet/shs/rmnet_shs_wq.c

+16 −16
Original line number Diff line number Diff line
@@ -325,7 +325,7 @@ void rmnet_shs_wq_hstat_alloc_nodes(u8 num_nodes_to_allocate, u8 is_store_perm) 
 */

struct rmnet_shs_wq_hstat_s *rmnet_shs_wq_get_new_hstat_node(void)

{

	struct rmnet_shs_wq_hstat_s *hnode;

	struct rmnet_shs_wq_hstat_s *hnode = NULL;

	struct rmnet_shs_wq_hstat_s *ret_node = NULL;

	unsigned long flags;
@@ -407,8 +407,8 @@ void rmnet_shs_wq_create_new_flow(struct rmnet_shs_skbn_s *node_p) 
/* Refresh the RPS mask associated with this flow */

void rmnet_shs_wq_update_hstat_rps_msk(struct rmnet_shs_wq_hstat_s *hstat_p)

{

	struct rmnet_shs_skbn_s *node_p;

	struct rmnet_shs_wq_ep_s *ep;

	struct rmnet_shs_skbn_s *node_p = NULL;

	struct rmnet_shs_wq_ep_s *ep = NULL;



	node_p = hstat_p->node;
@@ -773,7 +773,7 @@ u64 rmnet_shs_wq_get_max_pps_among_cores(u32 core_msk) 
u32 rmnet_shs_wq_get_dev_rps_msk(struct net_device *dev)

{

	u32 dev_rps_msk = 0;

	struct rmnet_shs_wq_ep_s *ep;

	struct rmnet_shs_wq_ep_s *ep = NULL;



	list_for_each_entry(ep, &rmnet_shs_wq_ep_tbl, ep_list_id) {

		if (!ep)
@@ -919,7 +919,7 @@ u16 rmnet_shs_wq_find_cpu_to_move_flows(u16 current_cpu, 


void rmnet_shs_wq_find_cpu_and_move_flows(u16 cur_cpu)

{

	struct rmnet_shs_wq_ep_s *ep;

	struct rmnet_shs_wq_ep_s *ep = NULL;

	u16 new_cpu;



	list_for_each_entry(ep, &rmnet_shs_wq_ep_tbl, ep_list_id) {
@@ -1069,7 +1069,7 @@ void rmnet_shs_wq_refresh_new_flow_list_per_ep(struct rmnet_shs_wq_ep_s *ep) 
}

void rmnet_shs_wq_refresh_new_flow_list(void)

{

	struct rmnet_shs_wq_ep_s *ep;

	struct rmnet_shs_wq_ep_s *ep = NULL;



	list_for_each_entry(ep, &rmnet_shs_wq_ep_tbl, ep_list_id) {

		if (!ep)
@@ -1088,7 +1088,7 @@ int rmnet_shs_wq_get_lpwr_cpu_new_flow(struct net_device *dev) 
	u8 lo_max;

	int cpu_assigned = -1;

	u8 is_match_found = 0;

	struct rmnet_shs_wq_ep_s *ep;

	struct rmnet_shs_wq_ep_s *ep = NULL;



	if (!dev) {

		rmnet_shs_crit_err[RMNET_SHS_NETDEV_ERR]++;
@@ -1133,7 +1133,7 @@ int rmnet_shs_wq_get_lpwr_cpu_new_flow(struct net_device *dev) 


int rmnet_shs_wq_get_perf_cpu_new_flow(struct net_device *dev)

{

	struct rmnet_shs_wq_ep_s *ep;

	struct rmnet_shs_wq_ep_s *ep = NULL;

	int cpu_assigned = -1;

	u8 hi_idx;

	u8 hi_max;
@@ -1197,11 +1197,11 @@ static int rmnet_shs_wq_time_check(time_t time, int num_flows) 


void rmnet_shs_wq_cleanup_hash_tbl(u8 force_clean)

{

	struct rmnet_shs_skbn_s *node_p;

	struct rmnet_shs_skbn_s *node_p = NULL;

	time_t tns2s;

	unsigned long ht_flags;

	struct rmnet_shs_wq_hstat_s *hnode = NULL;

	struct list_head *ptr, *next;

	struct list_head *ptr = NULL, *next = NULL;



	list_for_each_safe(ptr, next, &rmnet_shs_wq_hstat_tbl) {

		hnode = list_entry(ptr,
@@ -1271,7 +1271,7 @@ void rmnet_shs_wq_update_ep_rps_msk(struct rmnet_shs_wq_ep_s *ep) 


void rmnet_shs_wq_reset_ep_active(struct net_device *dev)

{

	struct rmnet_shs_wq_ep_s *ep;

	struct rmnet_shs_wq_ep_s *ep = NULL;



	list_for_each_entry(ep, &rmnet_shs_wq_ep_tbl, ep_list_id) {

		if (!ep)
@@ -1287,7 +1287,7 @@ void rmnet_shs_wq_reset_ep_active(struct net_device *dev) 


void rmnet_shs_wq_set_ep_active(struct net_device *dev)

{

	struct rmnet_shs_wq_ep_s *ep;

	struct rmnet_shs_wq_ep_s *ep = NULL;



	list_for_each_entry(ep, &rmnet_shs_wq_ep_tbl, ep_list_id) {

		if (!ep)
@@ -1304,7 +1304,7 @@ void rmnet_shs_wq_set_ep_active(struct net_device *dev) 


void rmnet_shs_wq_refresh_ep_masks(void)

{

	struct rmnet_shs_wq_ep_s *ep;

	struct rmnet_shs_wq_ep_s *ep = NULL;



	list_for_each_entry(ep, &rmnet_shs_wq_ep_tbl, ep_list_id) {
@@ -1339,7 +1339,7 @@ void rmnet_shs_update_cfg_mask(void) 
static void rmnet_shs_wq_update_stats(void)

{

	struct timespec time;

	struct rmnet_shs_wq_hstat_s *hnode;

	struct rmnet_shs_wq_hstat_s *hnode = NULL;



	(void) getnstimeofday(&time);

	rmnet_shs_wq_tnsec = RMNET_SHS_SEC_TO_NSEC(time.tv_sec) + time.tv_nsec;
@@ -1383,8 +1383,8 @@ void rmnet_shs_wq_process_wq(struct work_struct *work) 


void rmnet_shs_wq_clean_ep_tbl(void)

{

	struct rmnet_shs_wq_ep_s *ep;

	struct list_head *ptr, *next;

	struct rmnet_shs_wq_ep_s *ep = NULL;

	struct list_head *ptr = NULL, *next = NULL;



	list_for_each_safe(ptr, next, &rmnet_shs_wq_ep_tbl) {

		ep = list_entry(ptr, struct rmnet_shs_wq_ep_s, ep_list_id);